Wordpress Plugin
Monthly
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. No public exploit code or active exploitation has been confirmed at time of analysis.
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Unauthenticated broken access control in the BuddyForms WordPress plugin (ThemeKraft, versions ≤ 2.9.0) permits remote unauthenticated attackers to invoke restricted plugin functionality without valid credentials, yielding limited integrity and availability impact. The root cause is CWE-862 (Missing Authorization) - the plugin omits the required WordPress capability checks before executing certain operations, leaving those actions reachable by any network requestor. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the zero-authentication barrier keeps real-world risk elevated relative to the Medium CVSS score alone.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitrary files from the hosting server. The flaw stems from insufficient sanitization of user-supplied file path input (CWE-22), enabling directory traversal sequences to escape the intended download scope. An attacker with a low-privilege WordPress account can retrieve sensitive server files - including wp-config.php containing database credentials - with no public exploit identified at time of analysis.
Broken access control in the Robokassa Payment Gateway for WooCommerce plugin (versions ≤1.8.9) allows unauthenticated remote attackers to invoke restricted plugin actions, resulting in limited integrity and availability impact on affected WordPress e-commerce stores. The root cause is CWE-862 (Missing Authorization): the plugin fails to perform capability checks before executing sensitive operations, as reported by Patchstack (EUVD-2026-75513). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenticated low-privilege users to read arbitrary files from the web server by supplying directory traversal sequences in a file path parameter. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is network-exploitable with no complexity or interaction requirements beyond holding a basic WordPress account. Because WordPress plugins execute in the web server process context, the most critical exposure is likely reading wp-config.php, which contains database credentials and secret keys, enabling secondary attacks well beyond the medium 6.5 base score.
Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS rating of 4.3 (Medium) reflects the authenticated prerequisite and limited integrity-only impact.
Directory traversal in WP BackItUp Community Edition (WordPress plugin) ≤2.1.0 allows authenticated administrators to read the contents of arbitrary existing files on the server via the backup_file parameter in the download handler. The handler applies basename() normalization only when the traversal target path does not exist - meaning any real file, including wp-config.php or OS credential files, is returned without sanitization. No public exploit code has been identified at time of analysis, and the PR:H requirement limits the exploitable attack surface to accounts with WordPress administrator privileges or higher.
Unauthorized post-layout tampering in the Builderall Cheetah For WP WordPress plugin (≤3.0.2) allows any authenticated Subscriber-level user to disable the page builder layout on arbitrary posts site-wide. The wp_ajax_ba_cheetah_disable AJAX handler registers the disable() function without any capability check or nonce verification, and accepts an attacker-controlled post_id directly from $_POST input. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
Authorization bypass in WP Recipe Maker for WordPress (all versions ≤10.8.0) allows authenticated contributors to manipulate admin-authored recipe content without authorization. Specifically, any contributor-level user can unpublish any admin recipe by overwriting its post_status to draft or pending, and - when the plugin's recipe_use_author setting is configured as 'parent' - can additionally claim ownership of that recipe by substituting their own user ID into post_author. The vulnerability stems from missing authorization checks in the recipe-save code path. No public exploit has been identified and the CVE is not listed in CISA KEV.
Unauthorized token deletion in the Reviso Exporter for WooCommerce WordPress plugin (≤1.2.3) allows any authenticated subscriber-level user to permanently delete the plugin's stored Reviso Agreement Grant Token via an unprotected AJAX action, severing the WooCommerce-to-Reviso accounting service integration. The vulnerability stems from the `disconnect_callback()` function registered to `wp_ajax_wcefr-disconnect` performing no capability check and no nonce verification, meaning any logged-in WordPress user - including those with the lowest default role - can trigger it. No public exploit code is identified at time of analysis, and a vendor-released patch exists as of version 1.2.4.
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthenticated attackers add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step. The `wpfnl_load_payment` AJAX action is exposed via `wp_ajax_nopriv_` with no nonce verification, no capability check, and no server-side validation confirming the caller-supplied `product_id` corresponds to the configured offer on the specified `step_id`. Exploitation enables systematic checkout price manipulation and direct merchant revenue loss; no public exploit identified at time of analysis.
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. No public exploit or KEV listing has been identified at time of analysis; Wordfence is the reporting source.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.
Stored Cross-Site Scripting in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.5) allows authenticated contributor-level users to inject persistent arbitrary JavaScript into episode pages via the episode_contributor comment parameter. The vulnerability is compounded by two design flaws: contributor comments are stored in a plugin-managed custom database table that bypasses WordPress core's wp_kses_post sanitization filter, and the save_post hook fires without a nonce check, removing CSRF protection that would otherwise limit exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.
SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (≤3.8.3) allows any authenticated contributor to inject persistent JavaScript into site pages via unsanitized shortcode attributes. The payload executes in the browsers of all users who subsequently visit the affected page, potentially enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed; an upstream fix commit is available on GitHub though a tagged release version has not been independently confirmed.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.8.3) allows authenticated contributors to inject persistent malicious scripts via the `fallback`/`substitute` shortcode attributes. The attack exploits a gap between WordPress's save-time and render-time processing: hex-encoded payloads like `\x3cscript\x3e` pass through `wp_kses_post` as harmless literal strings at save time, but WordPress core's `shortcode_parse_atts()` calls `stripcslashes()` at render time, converting those sequences into live angle brackets before they reach the unescaped output sink. No public exploit code or active exploitation (CISA KEV) has been confirmed; the scope-changed CVSS 6.4 rating reflects impact on any visitor to an injected page.
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. No public exploit or active exploitation has been identified; a fix has been committed to the WordPress.org plugin repository (changeset 3656930).
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Authorization bypass in the Flamingo WordPress plugin (all versions ≤2.6.2) allows authenticated contributor-level users to enumerate sensitive internal metadata via unprotected WordPress core API endpoints. The plugin's capability filter `flamingo_map_meta_cap()` secures the admin UI but leaves XML-RPC `wp.getTerms` and admin-ajax `ajax-tag-search` without equivalent checks, exposing Contact Form 7 channel names, department identifiers, workflow names, submission counts per channel, and contact tag names. No public exploit is identified at time of analysis; the fix is available via plugin changeset 3611179.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the `custom_settings` shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
Directory traversal in JoomUnited's WP File Download WordPress plugin (all versions through 6.3.8) enables server-side file disclosure via a two-stage attack chain. A subscriber-level authenticated attacker first poisons a post-meta value through an unprotected file.save handler, after which the plugin's streaming endpoint — registered on WordPress's init hook with no authentication check — resolves and serves the traversed file path to any HTTP caller, including fully unauthenticated visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence has published the vulnerability details and a trac browser link pointing directly to the vulnerable code at app/site/init.php line 225.
Stored cross-site scripting in the Social Chat - Click To Chat App Button WordPress plugin (all versions ≤8.6.2) allows authenticated contributors to plant arbitrary JavaScript via the consent_message JSON attribute in the .qlwapp data-box element. When auto_open and consent_enabled are both set to 'yes' in the injected configuration, the malicious script fires immediately on page load with no additional victim interaction required, enabling session-cookie theft, credential harvesting, or malicious redirects against any visitor who loads the affected page. A patched version (8.6.3) is confirmed available via the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Missing authorization checks in Ultimate Maps by Supsystic WordPress plugin (versions through 1.5.3) allow unauthenticated network attackers to perform restricted write-class operations by exploiting incorrectly configured access control security levels. Reported by Patchstack via audit, this is a CWE-862 broken access control weakness where plugin endpoints lack proper capability checks before executing state-changing actions. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Missing authorization in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.17) exposes restricted functionality to unauthenticated remote callers, resulting in limited confidentiality impact. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no credentials or user interaction are needed, meaning any internet-accessible WordPress installation running the affected plugin version is reachable. No active exploitation has been identified at time of analysis, and no public exploit code is known.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Sensitive data exposure in the KP Agent Ready WordPress plugin (all versions before 1.2.08) causes the plugin to embed sensitive information - likely API keys or credentials for an external agent/chat service - in HTTP responses or frontend JavaScript assets delivered to site visitors. The CVSS 5.3 vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated, low-complexity exploitation accessible to any visitor. No public exploit or active exploitation is identified at time of analysis; vendor-released patch version 1.2.08 is available.
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-Based XSS in WPKoi Templates for Elementor (WordPress plugin) versions through 3.7.2 allows a low-privileged authenticated attacker to inject malicious scripts that execute in victims' browsers when they view affected pages. The flaw stems from insufficient neutralization of user-supplied input during web page generation, enabling script injection into the DOM without server-side reflection. No public exploit or CISA KEV listing has been identified at time of analysis, but Patchstack has publicly documented the vulnerability, lowering the bar for exploitation.
Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis, consistent with its Medium CVSS score of 5.3.
Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoints that should require authorization, allowing remote attackers to perform unauthorized write operations affecting directory listings and plugin data. The root cause is CWE-862 (Missing Authorization) - the plugin omits capability or permission checks on one or more AJAX or form handlers. With a CVSS 6.5 score reflecting limited integrity and availability impact, no public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. No public exploit code or active exploitation has been confirmed at time of analysis.
Broken access control in the IMPress for IDX Broker WordPress plugin (versions <= 3.3.0) allows authenticated subscriber-level users to perform actions or access data that should be restricted to higher-privileged roles. The flaw stems from missing authorization checks (CWE-862), enabling low-privilege WordPress accounts - such as those automatically created for site visitors or registered users - to cross privilege boundaries within the plugin's functionality. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Unauthenticated broken access control in the BuddyForms WordPress plugin (ThemeKraft, versions ≤ 2.9.0) permits remote unauthenticated attackers to invoke restricted plugin functionality without valid credentials, yielding limited integrity and availability impact. The root cause is CWE-862 (Missing Authorization) - the plugin omits the required WordPress capability checks before executing certain operations, leaving those actions reachable by any network requestor. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the zero-authentication barrier keeps real-world risk elevated relative to the Medium CVSS score alone.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitrary files from the hosting server. The flaw stems from insufficient sanitization of user-supplied file path input (CWE-22), enabling directory traversal sequences to escape the intended download scope. An attacker with a low-privilege WordPress account can retrieve sensitive server files - including wp-config.php containing database credentials - with no public exploit identified at time of analysis.
Broken access control in the Robokassa Payment Gateway for WooCommerce plugin (versions ≤1.8.9) allows unauthenticated remote attackers to invoke restricted plugin actions, resulting in limited integrity and availability impact on affected WordPress e-commerce stores. The root cause is CWE-862 (Missing Authorization): the plugin fails to perform capability checks before executing sensitive operations, as reported by Patchstack (EUVD-2026-75513). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenticated low-privilege users to read arbitrary files from the web server by supplying directory traversal sequences in a file path parameter. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is network-exploitable with no complexity or interaction requirements beyond holding a basic WordPress account. Because WordPress plugins execute in the web server process context, the most critical exposure is likely reading wp-config.php, which contains database credentials and secret keys, enabling secondary attacks well beyond the medium 6.5 base score.
Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.
Authorization bypass in the Advanced Contact Form 7 DB WordPress plugin (all versions through 2.1.3) allows authenticated attackers holding custom-level or higher roles to inject forged CSV submission records into any Contact Form 7 form managed by the plugin. The flaw is rooted in missing authorization checks within the plugin's import functionality - source code references confirm the vulnerable logic at specific lines in import_cf7_entry.class.php and import_cf7_csv.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS rating of 4.3 (Medium) reflects the authenticated prerequisite and limited integrity-only impact.
Directory traversal in WP BackItUp Community Edition (WordPress plugin) ≤2.1.0 allows authenticated administrators to read the contents of arbitrary existing files on the server via the backup_file parameter in the download handler. The handler applies basename() normalization only when the traversal target path does not exist - meaning any real file, including wp-config.php or OS credential files, is returned without sanitization. No public exploit code has been identified at time of analysis, and the PR:H requirement limits the exploitable attack surface to accounts with WordPress administrator privileges or higher.
Unauthorized post-layout tampering in the Builderall Cheetah For WP WordPress plugin (≤3.0.2) allows any authenticated Subscriber-level user to disable the page builder layout on arbitrary posts site-wide. The wp_ajax_ba_cheetah_disable AJAX handler registers the disable() function without any capability check or nonce verification, and accepts an attacker-controlled post_id directly from $_POST input. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
Authorization bypass in WP Recipe Maker for WordPress (all versions ≤10.8.0) allows authenticated contributors to manipulate admin-authored recipe content without authorization. Specifically, any contributor-level user can unpublish any admin recipe by overwriting its post_status to draft or pending, and - when the plugin's recipe_use_author setting is configured as 'parent' - can additionally claim ownership of that recipe by substituting their own user ID into post_author. The vulnerability stems from missing authorization checks in the recipe-save code path. No public exploit has been identified and the CVE is not listed in CISA KEV.
Unauthorized token deletion in the Reviso Exporter for WooCommerce WordPress plugin (≤1.2.3) allows any authenticated subscriber-level user to permanently delete the plugin's stored Reviso Agreement Grant Token via an unprotected AJAX action, severing the WooCommerce-to-Reviso accounting service integration. The vulnerability stems from the `disconnect_callback()` function registered to `wp_ajax_wcefr-disconnect` performing no capability check and no nonce verification, meaning any logged-in WordPress user - including those with the lowest default role - can trigger it. No public exploit code is identified at time of analysis, and a vendor-released patch exists as of version 1.2.4.
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthenticated attackers add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step. The `wpfnl_load_payment` AJAX action is exposed via `wp_ajax_nopriv_` with no nonce verification, no capability check, and no server-side validation confirming the caller-supplied `product_id` corresponds to the configured offer on the specified `step_id`. Exploitation enables systematic checkout price manipulation and direct merchant revenue loss; no public exploit identified at time of analysis.
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. No public exploit or KEV listing has been identified at time of analysis; Wordfence is the reporting source.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.
Stored Cross-Site Scripting in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.5) allows authenticated contributor-level users to inject persistent arbitrary JavaScript into episode pages via the episode_contributor comment parameter. The vulnerability is compounded by two design flaws: contributor comments are stored in a plugin-managed custom database table that bypasses WordPress core's wp_kses_post sanitization filter, and the save_post hook fires without a nonce check, removing CSRF protection that would otherwise limit exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.
SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (≤3.8.3) allows any authenticated contributor to inject persistent JavaScript into site pages via unsanitized shortcode attributes. The payload executes in the browsers of all users who subsequently visit the affected page, potentially enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed; an upstream fix commit is available on GitHub though a tagged release version has not been independently confirmed.
Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.8.3) allows authenticated contributors to inject persistent malicious scripts via the `fallback`/`substitute` shortcode attributes. The attack exploits a gap between WordPress's save-time and render-time processing: hex-encoded payloads like `\x3cscript\x3e` pass through `wp_kses_post` as harmless literal strings at save time, but WordPress core's `shortcode_parse_atts()` calls `stripcslashes()` at render time, converting those sequences into live angle brackets before they reach the unescaped output sink. No public exploit code or active exploitation (CISA KEV) has been confirmed; the scope-changed CVSS 6.4 rating reflects impact on any visitor to an injected page.
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Arbitrary shortcode execution in Beaver Builder Page Builder for WordPress (all versions ≤2.10.3.1) allows unauthenticated remote attackers to invoke any registered WordPress shortcode via an insufficiently validated action handler that passes attacker-controlled input directly to do_shortcode(). Because shortcode impact depends on what handlers are registered in the environment, real-world consequences range from limited content disclosure or modification to chained exploitation through dangerous third-party shortcodes. No public exploit has been identified at time of analysis, and a patch was released as version 2.10.3.2.
Stored Cross-Site Scripting in the Zephyr Project Manager WordPress plugin (all versions through 3.3.205) allows authenticated attackers holding Custom-level access or higher to inject persistent JavaScript via the 'message' parameter across three distinct code paths (Projects.php, AjaxHandler.php, Tasks.php). The injected payload executes in the browser of any subsequent user who visits the affected page, enabling session hijacking, credential harvesting, or UI redirection. No public exploit or active exploitation has been identified; a fix has been committed to the WordPress.org plugin repository (changeset 3656930).
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Unauthenticated privilege escalation in the Product Catalog Enquiry for WooCommerce by MultiVendorX WordPress plugin (versions <= 6.1.4) permits remote unauthenticated attackers to invoke restricted plugin functionality without holding any site credentials. The root cause is incorrect privilege assignment (CWE-266), where specific plugin endpoints fail to enforce proper capability checks before executing sensitive actions. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, the zero-authentication, low-complexity network vector makes automated scanning and opportunistic abuse straightforward against any WooCommerce site running the affected plugin.
Arbitrary shortcode execution in the Icegram Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows unauthenticated network attackers to invoke registered WordPress shortcodes without authentication. The flaw originates in the plugin's email workflow and subscription handling code, which passes user-controlled input to `do_shortcode()` without adequate validation - enabling attackers to trigger any shortcode registered on the target site. Depending on the shortcodes available, impact ranges from information disclosure and content manipulation to potential code execution; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Authorization bypass in the Flamingo WordPress plugin (all versions ≤2.6.2) allows authenticated contributor-level users to enumerate sensitive internal metadata via unprotected WordPress core API endpoints. The plugin's capability filter `flamingo_map_meta_cap()` secures the admin UI but leaves XML-RPC `wp.getTerms` and admin-ajax `ajax-tag-search` without equivalent checks, exposing Contact Form 7 channel names, department identifiers, workflow names, submission counts per channel, and contact tag names. No public exploit is identified at time of analysis; the fix is available via plugin changeset 3611179.
Stored Cross-Site Scripting in the Powerkit WordPress plugin (all versions up to and including 3.0.4) allows authenticated Contributors to permanently embed malicious JavaScript into published pages via a flawed regex-based HTML attribute parser in the Lazy Load module's `content_process_images` function. Any site visitor who subsequently loads an injected page triggers script execution in their browser context, enabling session hijacking, credential theft, or malicious redirects. A fix is confirmed available via WordPress plugin Trac changeset 3604146; no active exploitation or public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Pods - Custom Content Types and Fields WordPress plugin (all versions ≤ 3.3.9.1) allows contributor-level authenticated attackers to inject persistent malicious scripts via the 'not_found' shortcode attribute, executing in victim browsers on page load. The root cause is insufficient sanitization and output escaping in general.php (lines 1399, 2535, 2539) and PodsInit.php (line 514), as identified by Wordfence. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level access bar is low on multi-author WordPress sites.
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the `custom_settings` shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
Directory traversal in JoomUnited's WP File Download WordPress plugin (all versions through 6.3.8) enables server-side file disclosure via a two-stage attack chain. A subscriber-level authenticated attacker first poisons a post-meta value through an unprotected file.save handler, after which the plugin's streaming endpoint — registered on WordPress's init hook with no authentication check — resolves and serves the traversed file path to any HTTP caller, including fully unauthenticated visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence has published the vulnerability details and a trac browser link pointing directly to the vulnerable code at app/site/init.php line 225.
Stored cross-site scripting in the Social Chat - Click To Chat App Button WordPress plugin (all versions ≤8.6.2) allows authenticated contributors to plant arbitrary JavaScript via the consent_message JSON attribute in the .qlwapp data-box element. When auto_open and consent_enabled are both set to 'yes' in the injected configuration, the malicious script fires immediately on page load with no additional victim interaction required, enabling session-cookie theft, credential harvesting, or malicious redirects against any visitor who loads the affected page. A patched version (8.6.3) is confirmed available via the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.
Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.
Missing authorization checks in Crocoblock's JetPopup WordPress plugin (versions through 2.0.20.2) allow unauthenticated remote attackers to access functionality or data that should be restricted to authorized users. The flaw, classified as CWE-862 (Missing Authorization), enables exploitation of incorrectly configured access control levels, resulting in low-impact information disclosure with no integrity or availability consequence. No public exploit has been identified at time of analysis, and EPSS and KEV data were not provided.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Missing authorization in WCFM Membership WordPress plugin through version 2.11.11 allows unauthenticated remote attackers to exploit incorrectly configured access control and perform unauthorized write operations on protected endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-accessible without any authentication, though impact is bounded to limited integrity modification (I:L) with no confidentiality or availability exposure. No public exploit code and no active exploitation have been identified at time of analysis.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Missing authorization checks in Ultimate Maps by Supsystic WordPress plugin (versions through 1.5.3) allow unauthenticated network attackers to perform restricted write-class operations by exploiting incorrectly configured access control security levels. Reported by Patchstack via audit, this is a CWE-862 broken access control weakness where plugin endpoints lack proper capability checks before executing state-changing actions. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Missing authorization in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.17) exposes restricted functionality to unauthenticated remote callers, resulting in limited confidentiality impact. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no credentials or user interaction are needed, meaning any internet-accessible WordPress installation running the affected plugin version is reachable. No active exploitation has been identified at time of analysis, and no public exploit code is known.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Sensitive data exposure in the KP Agent Ready WordPress plugin (all versions before 1.2.08) causes the plugin to embed sensitive information - likely API keys or credentials for an external agent/chat service - in HTTP responses or frontend JavaScript assets delivered to site visitors. The CVSS 5.3 vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated, low-complexity exploitation accessible to any visitor. No public exploit or active exploitation is identified at time of analysis; vendor-released patch version 1.2.08 is available.
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-Based XSS in WPKoi Templates for Elementor (WordPress plugin) versions through 3.7.2 allows a low-privileged authenticated attacker to inject malicious scripts that execute in victims' browsers when they view affected pages. The flaw stems from insufficient neutralization of user-supplied input during web page generation, enabling script injection into the DOM without server-side reflection. No public exploit or CISA KEV listing has been identified at time of analysis, but Patchstack has publicly documented the vulnerability, lowering the bar for exploitation.
Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis, consistent with its Medium CVSS score of 5.3.
Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoints that should require authorization, allowing remote attackers to perform unauthorized write operations affecting directory listings and plugin data. The root cause is CWE-862 (Missing Authorization) - the plugin omits capability or permission checks on one or more AJAX or form handlers. With a CVSS 6.5 score reflecting limited integrity and availability impact, no public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.