Wordpress Plugin
Monthly
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Missing authorization in the Rentsyst WordPress rental plugin (≤2.1.2) permits unauthenticated remote attackers to access restricted endpoints or functionality without any capability checks. The CVSS vector (PR:N, C:L, I:N, A:N) confirms the flaw exposes read-only data to network-reachable, unauthenticated requesters, with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated denial of service in WP Go Maps WordPress plugin (versions <= 10.1.08) allows remote attackers without any credentials to exhaust server resources, degrading or disrupting availability for the affected WordPress installation. The vulnerability stems from CWE-770 (resource allocation without limits or throttling), enabling unconstrained consumption of server capacity via crafted network requests. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned availability impact is rated Low, suggesting partial rather than complete service disruption.
Server-Side Request Forgery in the Broken Link Checker WordPress plugin (WPMU Dev, versions ≤ 2.4.14) allows high-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests from its editor component. The CVSS scope-change flag (S:C) indicates the forged requests can reach resources outside the WordPress application boundary, such as cloud instance metadata endpoints or internal network services. No public exploit has been identified at time of analysis.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through 3.2.9) permits any remote unauthenticated user to reach one or more restricted plugin endpoints, yielding limited information disclosure. The root cause is missing authorization checks (CWE-862) rather than a bypass of the authentication mechanism itself. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole reporting source.
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Stored Cross-Site Scripting in the Easy Waveform Player WordPress plugin (≤1.2.2) allows authenticated Contributor-level users to inject arbitrary JavaScript via the shortcode_easywaveformplayer() function due to missing input sanitization and output escaping. The payload persists server-side and executes in every visitor's browser upon page load, with scope change enabling cross-origin script execution. No public exploit or CISA KEV listing has been identified at time of analysis; a patch commit (changeset 3674516) is visible in the WordPress plugin SVN repository.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authenticated users to perform actions beyond their authorized scope, classified under CWE-862 (Missing Authorization). Reported by Patchstack with a CVSS 3.1 score of 5.3 Medium, the flaw is particularly impactful on WordPress sites with open user registration, where any self-registered subscriber could exploit it. No public exploit code and no CISA KEV listing are identified at time of analysis.
Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
Insecure Direct Object Reference in WP Data Access plugin for WordPress (all versions through 5.5.68) exposes protected app container data to unauthenticated attackers via the `check_app_access` function. The flaw stems from a logical mismatch: authorization is validated against the `app_id` parameter, but the subsequent data retrieval uses `cnt_id` without verifying that the requested container actually belongs to the authorized app - allowing a user to pass an authorized `app_id` to clear the access gate while supplying an arbitrary `cnt_id` to reach a different container's data. No public exploit code or KEV listing exists at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to abuse opportunistically.
Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.
Stored cross-site scripting in the Betheme theme for WordPress (all versions through 28.4) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts into pages via unsanitized attributes of the 'icon_box_2' shortcode. The injected payload executes in the browser of any user who subsequently loads the affected page, including administrators, enabling session hijacking or privilege escalation. No public exploit code has been identified and the vulnerability carries no CISA KEV listing at time of analysis, but the low access barrier in multi-author WordPress environments elevates practical risk.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.
Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. No public exploit code or CISA KEV listing was identified at time of analysis; exploitation requires tricking a victim into clicking a crafted link.
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.
Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.
Broken access control in AutomatorWP WordPress plugin (versions ≤ 5.8.3) allows authenticated subscriber-level users to perform privileged operations without authorization. Subscribers - the lowest authenticated role in WordPress - can invoke plugin functionality reserved for editors or administrators, resulting in high integrity impact against affected sites. No public exploit code or active exploitation has been identified at time of analysis; CVSS scores this at 6.5 Medium, reflecting meaningful but constrained impact bounded by the requirement for a valid account.
Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.
Cross-site scripting in ThemeGrill's Magazine Blocks WordPress plugin (versions ≤1.8.6) enables an authenticated Contributor to inject malicious scripts into block content that execute in a victim's browser upon page view. The CVSS scope-change metric (S:C) reflects that injected code escapes the plugin context and runs in the victim's browser session, potentially allowing session token theft or unauthorized admin actions. No public exploit code or active exploitation has been identified at time of analysis, but the Patchstack-reported flaw and ENISA EUVD-2026-64788 entry confirm the vulnerability.
Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.
Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.
Cross-site request forgery in the Simple Membership MailChimp Integration WordPress plugin (versions before 1.9.8) allows a network-positioned attacker to replace the site's configured MailChimp API key with one under attacker control by tricking a logged-in administrator into loading a crafted page. Once the API key is substituted, all subsequent member registration data - including name, email address, and membership level - is silently forwarded to the attacker's MailChimp account until the change is detected. A publicly available exploit exists and a vendor patch (1.9.8) is available; no active exploitation has been confirmed in CISA KEV.
Missing authorization in the Classified Listing WordPress plugin (≤6.1.1) allows authenticated low-privileged users to invoke restricted plugin functionality without the required capability checks. Reported by Patchstack with a CVSS 5.4 medium score, the flaw falls under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user holds the appropriate ACL permissions before executing sensitive actions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Missing authorization in the Rentsyst WordPress rental plugin (≤2.1.2) permits unauthenticated remote attackers to access restricted endpoints or functionality without any capability checks. The CVSS vector (PR:N, C:L, I:N, A:N) confirms the flaw exposes read-only data to network-reachable, unauthenticated requesters, with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthenticated denial of service in WP Go Maps WordPress plugin (versions <= 10.1.08) allows remote attackers without any credentials to exhaust server resources, degrading or disrupting availability for the affected WordPress installation. The vulnerability stems from CWE-770 (resource allocation without limits or throttling), enabling unconstrained consumption of server capacity via crafted network requests. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated denial of service against WordPress sites running Really Simple SSL plugin version 9.8.0 and earlier allows remote attackers to partially degrade site availability without any credentials. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the plugin fails to constrain resource consumption on certain request paths, enabling an attacker to send crafted requests that exhaust server resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned availability impact is rated Low, suggesting partial rather than complete service disruption.
Server-Side Request Forgery in the Broken Link Checker WordPress plugin (WPMU Dev, versions ≤ 2.4.14) allows high-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests from its editor component. The CVSS scope-change flag (S:C) indicates the forged requests can reach resources outside the WordPress application boundary, such as cloud instance metadata endpoints or internal network services. No public exploit has been identified at time of analysis.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Unauthenticated broken access control in the Ultimate Gift Cards for WooCommerce WordPress plugin (all versions through 3.2.9) permits any remote unauthenticated user to reach one or more restricted plugin endpoints, yielding limited information disclosure. The root cause is missing authorization checks (CWE-862) rather than a bypass of the authentication mechanism itself. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole reporting source.
Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Stored Cross-Site Scripting in the Easy Waveform Player WordPress plugin (≤1.2.2) allows authenticated Contributor-level users to inject arbitrary JavaScript via the shortcode_easywaveformplayer() function due to missing input sanitization and output escaping. The payload persists server-side and executes in every visitor's browser upon page load, with scope change enabling cross-origin script execution. No public exploit or CISA KEV listing has been identified at time of analysis; a patch commit (changeset 3674516) is visible in the WordPress plugin SVN repository.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authenticated users to perform actions beyond their authorized scope, classified under CWE-862 (Missing Authorization). Reported by Patchstack with a CVSS 3.1 score of 5.3 Medium, the flaw is particularly impactful on WordPress sites with open user registration, where any self-registered subscriber could exploit it. No public exploit code and no CISA KEV listing are identified at time of analysis.
Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
Insecure Direct Object Reference in WP Data Access plugin for WordPress (all versions through 5.5.68) exposes protected app container data to unauthenticated attackers via the `check_app_access` function. The flaw stems from a logical mismatch: authorization is validated against the `app_id` parameter, but the subsequent data retrieval uses `cnt_id` without verifying that the requested container actually belongs to the authorized app - allowing a user to pass an authorized `app_id` to clear the access gate while supplying an arbitrary `cnt_id` to reach a different container's data. No public exploit code or KEV listing exists at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to abuse opportunistically.
Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.
Stored cross-site scripting in the Betheme theme for WordPress (all versions through 28.4) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts into pages via unsanitized attributes of the 'icon_box_2' shortcode. The injected payload executes in the browser of any user who subsequently loads the affected page, including administrators, enabling session hijacking or privilege escalation. No public exploit code has been identified and the vulnerability carries no CISA KEV listing at time of analysis, but the low access barrier in multi-author WordPress environments elevates practical risk.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.
Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. No public exploit code or CISA KEV listing was identified at time of analysis; exploitation requires tricking a victim into clicking a crafted link.
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.
Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.
Broken access control in AutomatorWP WordPress plugin (versions ≤ 5.8.3) allows authenticated subscriber-level users to perform privileged operations without authorization. Subscribers - the lowest authenticated role in WordPress - can invoke plugin functionality reserved for editors or administrators, resulting in high integrity impact against affected sites. No public exploit code or active exploitation has been identified at time of analysis; CVSS scores this at 6.5 Medium, reflecting meaningful but constrained impact bounded by the requirement for a valid account.
Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.
Cross-site scripting in ThemeGrill's Magazine Blocks WordPress plugin (versions ≤1.8.6) enables an authenticated Contributor to inject malicious scripts into block content that execute in a victim's browser upon page view. The CVSS scope-change metric (S:C) reflects that injected code escapes the plugin context and runs in the victim's browser session, potentially allowing session token theft or unauthorized admin actions. No public exploit code or active exploitation has been identified at time of analysis, but the Patchstack-reported flaw and ENISA EUVD-2026-64788 entry confirm the vulnerability.
Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.