Wordpress Plugin
Monthly
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.
Broken access control in the RepairBuddy WordPress plugin (versions up to and including 4.1223) allows unauthenticated remote attackers to perform unauthorized actions against affected WordPress installations. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the requesting user's identity or capability. The integrity impact (I:L) suggests unauthorized modification of repair shop records or plugin settings is possible, though confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).
Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.
Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
Stored cross-site scripting in the Media Library Assistant WordPress plugin (versions through 3.39) allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other users - including administrators - who subsequently view affected media library pages. The Changed scope (S:C) in the CVSS vector confirms the payload escapes the plugin context and can affect the broader WordPress admin interface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and low privilege requirement make it straightforward to exploit once authenticated. Reported by Patchstack (ENISA EUVD-2026-62210).
Missing authorization in the B2BKing WordPress/WooCommerce plugin (versions through 5.2.30) allows authenticated low-privilege users to exploit incorrectly configured access control security levels, potentially accessing B2B wholesale pricing tiers, customer group data, or restricted functionality reserved for higher-privilege roles. Reported by Patchstack's audit team under ENISA EUVD-2026-62211, this broken access control flaw (CWE-862) carries a CVSS 5.4 Medium score. No public exploit code or CISA KEV listing is identified at time of analysis, limiting immediate threat urgency.
Stored Cross-Site Scripting in the PublishPress Series WordPress plugin (versions through 2.17.0) allows a high-privileged attacker to persist malicious JavaScript payloads that execute in victims' browsers when affected content is viewed. The scope change in the CVSS vector confirms the injected script crosses trust boundaries, affecting users beyond the administrative context where the payload was stored. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of moderate, authenticated risk.
Stored cross-site scripting in the Draft List WordPress plugin (versions through 2.6.4) allows authenticated users with low privileges to inject persistent malicious JavaScript into draft-related fields rendered by the plugin. When a higher-privileged WordPress user such as an administrator or editor views the draft list output, the stored payload executes in their browser, enabling session hijacking or unauthorized administrative actions. Reported by Patchstack (EUVD-2026-62208); no public exploit code or active exploitation confirmed at time of analysis.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, though the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) makes opportunistic scanning a realistic threat vector.
Unauthenticated sensitive data exposure in the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (versions ≤ 1.16.20) allows remote unauthenticated attackers to retrieve sensitive information without credentials or user interaction. Classified under CWE-497 and reported by Patchstack (EUVD-2026-60815), the flaw permits unauthorized parties to access data that should be confined to privileged or internal control spheres - likely via improperly access-controlled REST API or AJAX endpoints common in WordPress plugin architecture. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, no-authentication CVSS vector means exploitation would be trivial if targeted.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Broken authentication in the Flutterwave WooCommerce WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position, making it trivially accessible to any internet-connected attacker targeting WordPress sites running this payment gateway plugin. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken authentication in the Piraeus Bank WooCommerce Payment Gateway WordPress plugin version 3.2.0 allows unauthenticated remote attackers to bypass authentication controls, resulting in low-severity integrity and availability impacts. Reported by Patchstack and tracked under ENISA EUVD-2026-60804, this CWE-288 flaw enables access via an alternate path or channel without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers. The vulnerability (CWE-22) allows a WooCommerce shop manager to craft requests that traverse directory boundaries and retrieve arbitrary files - including sensitive configuration files such as wp-config.php - directly from the web server. No public exploit code or active exploitation has been identified at time of analysis, but the confidentiality impact is complete given successful exploitation.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.
Stored Cross-Site Scripting in the Video Conferencing with Zoom WordPress plugin (≤ 4.6.8) allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users such as editors or administrators. The CVSS scope-changed metric (S:C) confirms the injected payload crosses security boundaries, enabling session hijacking or unauthorized administrative actions against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a medium-severity, authenticated attack vector requiring targeted abuse of contributor-level access.
Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.
Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Server-Side Request Forgery in the Aotuman Grab WeChat Articles WordPress plugin (versions <= 2.0.1) allows low-privileged authenticated users at the subscriber role to force the WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network hosts. The CVSS Scope:Changed metric confirms the vulnerability can reach resources outside the WordPress application boundary, such as cloud metadata endpoints or internal services. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
SQL injection in the WC Vendors WordPress plugin (all versions through 2.7.0) enables authenticated shop managers to exfiltrate arbitrary records from the WordPress database via the 'status' parameter across multiple REST API admin endpoints. The flaw exploits a sanitization bypass specific to the WordPress REST API: WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before registered sanitize callbacks execute, stripping WordPress's magic-quotes protection while leaving SQL metacharacters intact; sanitize_text_field then removes HTML but passes quotes and comment sequences through to the underlying SQL query unchanged. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the high confidentiality impact and the fact that multivendor marketplaces routinely grant shop manager access to untrusted third-party sellers elevate real-world risk for this plugin's typical deployment.
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Second-order SQL Injection in the Slider Hero with Video Background, Animation WordPress plugin (versions up to and including 9.1.7) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database. The vulnerability arises in the slide-duplication workflow: slide fields are safely parameterized on write, but re-read as raw strings and concatenated directly into an INSERT statement without any escaping when an administrator invokes the heroduplicateslider action. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.
Directory traversal in the StoreEngine WordPress plugin (Kodezen) through version 2.1.1 exposes arbitrary server files to authenticated users holding vendor-level access or higher. The flaw resides in the `parse_file_path` function, which insufficiently sanitizes file path input across the plugin's download handler and multi-vendor addon components, allowing path sequences to escape the intended directory. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the confidentiality impact is high given that readable files may include WordPress configuration, database credentials, or private keys.
PHP Object Injection in the Turnkey bbPress by WeaverTheme WordPress plugin (all versions through 1.7.1) allows authenticated administrators to pass arbitrary PHP objects through the plugin's settings-restore handler, which reads an uploaded file's raw contents and passes them directly to `unserialize()` without validation. The immediate danger is conditional: no POP chain exists within the plugin itself, but any co-installed plugin or theme supplying a POP chain elevates this to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV.
Stored Cross-Site Scripting in the Snippet Shortcodes WordPress plugin (all versions through 5.2.0) allows any authenticated WordPress user with at least contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Once injected, the payload executes in the browser of any user who visits the affected page, including administrators, enabling session hijacking or privilege escalation. No active exploitation has been confirmed by CISA KEV, and no public exploit code is explicitly referenced in available intelligence; however, the Wordfence threat advisory and WordPress plugin trac source references document the vulnerability thoroughly.
SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.
Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the `toocheke_series_bg_color_save()` function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without `esc_attr()` escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Stored Cross-Site Scripting in the Serious Slider WordPress plugin (all versions up to and including 1.4.0) allows authenticated contributors to inject persistent malicious scripts via the 'theme' shortcode attribute, which then execute in the browser of any user who subsequently visits the affected page. The flaw originates from insufficient sanitization and output escaping in multiple code paths within inc/shortcodes.php, as confirmed by Wordfence and EUVD-2026-59867. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Stored Cross-Site Scripting in the Advanced File Manager WordPress plugin (versions up to and including 5.4.12) allows unauthenticated network attackers to inject persistent malicious scripts via the unsanitized 'soundFile' parameter in elFinder.js. Successful exploitation grants script execution in an authenticated WordPress administrator's browser context, enabling session hijacking, credential theft, or administrative action abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is substantially constrained by a non-trivial domain-prefix precondition detailed below.
Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holding the translator role or above to inject persistent malicious scripts via crafted PO file extracted comments. When an affected translation page is subsequently loaded by another authenticated user - including site administrators - the stored payload executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix commit is confirmed in the WordPress plugin trac repository, and the Wordfence advisory provides the authoritative disclosure record.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authenticated attackers holding at minimum a contributor role to inject persistent JavaScript payloads via the 'question_title' parameter. The injected script executes in the browser of any user who subsequently views a page containing the poisoned quiz, enabling session hijacking, credential harvesting, or unauthorized administrative actions. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; however, the scope change noted in the CVSS vector underscores that impact crosses the boundary from the injecting contributor into every visiting user's browser context.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
SQL Injection in the Fullscreen Galleria WordPress plugin (all versions through 1.6.12) allows authenticated attackers holding contributor-level access or higher to append arbitrary SQL subqueries via an unsanitized 'href' attribute in post content, enabling full read-access to the WordPress database. Multiple vulnerable sinks in galleria-fs.php (lines 68, 74, 146, 1074, 1078) were identified and disclosed by Wordfence; upstream fix commits have been published to the WordPress plugin repository. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this at moderate real-world priority, elevated for sites with open contributor registration.
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.
Broken access control in the RepairBuddy WordPress plugin (versions up to and including 4.1223) allows unauthenticated remote attackers to perform unauthorized actions against affected WordPress installations. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the requesting user's identity or capability. The integrity impact (I:L) suggests unauthorized modification of repair shop records or plugin settings is possible, though confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).
Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.
Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
Stored cross-site scripting in the Media Library Assistant WordPress plugin (versions through 3.39) allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other users - including administrators - who subsequently view affected media library pages. The Changed scope (S:C) in the CVSS vector confirms the payload escapes the plugin context and can affect the broader WordPress admin interface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and low privilege requirement make it straightforward to exploit once authenticated. Reported by Patchstack (ENISA EUVD-2026-62210).
Missing authorization in the B2BKing WordPress/WooCommerce plugin (versions through 5.2.30) allows authenticated low-privilege users to exploit incorrectly configured access control security levels, potentially accessing B2B wholesale pricing tiers, customer group data, or restricted functionality reserved for higher-privilege roles. Reported by Patchstack's audit team under ENISA EUVD-2026-62211, this broken access control flaw (CWE-862) carries a CVSS 5.4 Medium score. No public exploit code or CISA KEV listing is identified at time of analysis, limiting immediate threat urgency.
Stored Cross-Site Scripting in the PublishPress Series WordPress plugin (versions through 2.17.0) allows a high-privileged attacker to persist malicious JavaScript payloads that execute in victims' browsers when affected content is viewed. The scope change in the CVSS vector confirms the injected script crosses trust boundaries, affecting users beyond the administrative context where the payload was stored. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of moderate, authenticated risk.
Stored cross-site scripting in the Draft List WordPress plugin (versions through 2.6.4) allows authenticated users with low privileges to inject persistent malicious JavaScript into draft-related fields rendered by the plugin. When a higher-privileged WordPress user such as an administrator or editor views the draft list output, the stored payload executes in their browser, enabling session hijacking or unauthorized administrative actions. Reported by Patchstack (EUVD-2026-62208); no public exploit code or active exploitation confirmed at time of analysis.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, though the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) makes opportunistic scanning a realistic threat vector.
Unauthenticated sensitive data exposure in the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (versions ≤ 1.16.20) allows remote unauthenticated attackers to retrieve sensitive information without credentials or user interaction. Classified under CWE-497 and reported by Patchstack (EUVD-2026-60815), the flaw permits unauthorized parties to access data that should be confined to privileged or internal control spheres - likely via improperly access-controlled REST API or AJAX endpoints common in WordPress plugin architecture. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, no-authentication CVSS vector means exploitation would be trivial if targeted.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Broken authentication in the Flutterwave WooCommerce WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position, making it trivially accessible to any internet-connected attacker targeting WordPress sites running this payment gateway plugin. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken authentication in the Piraeus Bank WooCommerce Payment Gateway WordPress plugin version 3.2.0 allows unauthenticated remote attackers to bypass authentication controls, resulting in low-severity integrity and availability impacts. Reported by Patchstack and tracked under ENISA EUVD-2026-60804, this CWE-288 flaw enables access via an alternate path or channel without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers. The vulnerability (CWE-22) allows a WooCommerce shop manager to craft requests that traverse directory boundaries and retrieve arbitrary files - including sensitive configuration files such as wp-config.php - directly from the web server. No public exploit code or active exploitation has been identified at time of analysis, but the confidentiality impact is complete given successful exploitation.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.
Stored Cross-Site Scripting in the Video Conferencing with Zoom WordPress plugin (≤ 4.6.8) allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users such as editors or administrators. The CVSS scope-changed metric (S:C) confirms the injected payload crosses security boundaries, enabling session hijacking or unauthorized administrative actions against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a medium-severity, authenticated attack vector requiring targeted abuse of contributor-level access.
Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.
Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Server-Side Request Forgery in the Aotuman Grab WeChat Articles WordPress plugin (versions <= 2.0.1) allows low-privileged authenticated users at the subscriber role to force the WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network hosts. The CVSS Scope:Changed metric confirms the vulnerability can reach resources outside the WordPress application boundary, such as cloud metadata endpoints or internal services. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
SQL injection in the WC Vendors WordPress plugin (all versions through 2.7.0) enables authenticated shop managers to exfiltrate arbitrary records from the WordPress database via the 'status' parameter across multiple REST API admin endpoints. The flaw exploits a sanitization bypass specific to the WordPress REST API: WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before registered sanitize callbacks execute, stripping WordPress's magic-quotes protection while leaving SQL metacharacters intact; sanitize_text_field then removes HTML but passes quotes and comment sequences through to the underlying SQL query unchanged. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the high confidentiality impact and the fact that multivendor marketplaces routinely grant shop manager access to untrusted third-party sellers elevate real-world risk for this plugin's typical deployment.
SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Second-order SQL Injection in the Slider Hero with Video Background, Animation WordPress plugin (versions up to and including 9.1.7) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database. The vulnerability arises in the slide-duplication workflow: slide fields are safely parameterized on write, but re-read as raw strings and concatenated directly into an INSERT statement without any escaping when an administrator invokes the heroduplicateslider action. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.
Directory traversal in the StoreEngine WordPress plugin (Kodezen) through version 2.1.1 exposes arbitrary server files to authenticated users holding vendor-level access or higher. The flaw resides in the `parse_file_path` function, which insufficiently sanitizes file path input across the plugin's download handler and multi-vendor addon components, allowing path sequences to escape the intended directory. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the confidentiality impact is high given that readable files may include WordPress configuration, database credentials, or private keys.
PHP Object Injection in the Turnkey bbPress by WeaverTheme WordPress plugin (all versions through 1.7.1) allows authenticated administrators to pass arbitrary PHP objects through the plugin's settings-restore handler, which reads an uploaded file's raw contents and passes them directly to `unserialize()` without validation. The immediate danger is conditional: no POP chain exists within the plugin itself, but any co-installed plugin or theme supplying a POP chain elevates this to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV.
Stored Cross-Site Scripting in the Snippet Shortcodes WordPress plugin (all versions through 5.2.0) allows any authenticated WordPress user with at least contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Once injected, the payload executes in the browser of any user who visits the affected page, including administrators, enabling session hijacking or privilege escalation. No active exploitation has been confirmed by CISA KEV, and no public exploit code is explicitly referenced in available intelligence; however, the Wordfence threat advisory and WordPress plugin trac source references document the vulnerability thoroughly.
SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.
Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the `toocheke_series_bg_color_save()` function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without `esc_attr()` escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Stored Cross-Site Scripting in the Serious Slider WordPress plugin (all versions up to and including 1.4.0) allows authenticated contributors to inject persistent malicious scripts via the 'theme' shortcode attribute, which then execute in the browser of any user who subsequently visits the affected page. The flaw originates from insufficient sanitization and output escaping in multiple code paths within inc/shortcodes.php, as confirmed by Wordfence and EUVD-2026-59867. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Stored Cross-Site Scripting in the Advanced File Manager WordPress plugin (versions up to and including 5.4.12) allows unauthenticated network attackers to inject persistent malicious scripts via the unsanitized 'soundFile' parameter in elFinder.js. Successful exploitation grants script execution in an authenticated WordPress administrator's browser context, enabling session hijacking, credential theft, or administrative action abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is substantially constrained by a non-trivial domain-prefix precondition detailed below.
Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holding the translator role or above to inject persistent malicious scripts via crafted PO file extracted comments. When an affected translation page is subsequently loaded by another authenticated user - including site administrators - the stored payload executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix commit is confirmed in the WordPress plugin trac repository, and the Wordfence advisory provides the authoritative disclosure record.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.
CSS injection in WC Product Table Lite (WordPress plugin, versions ≤ 5.6.0) allows unauthenticated remote attackers to embed arbitrary CSS into any page rendering a product table with sticky sidebar enabled. The flaw originates in the unauthenticated `wp_ajax_nopriv_wcpt_ajax` AJAX handler, which JSON-decodes attacker-supplied shortcode attributes, enforces only a key-name allowlist without sanitizing values, and interpolates the raw `laptop_scroll_offset` value directly into inline CSS without numeric casting or escaping. While the assigned CVSS score of 5.3 carries C:N, the real-world impact is broader: the injection vector supports CSS-based data exfiltration via attribute-selector background-image chaining, UI redressing, and phishing that bypasses CSPs permitting inline styles - risks not captured in the base score. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authenticated attackers holding at minimum a contributor role to inject persistent JavaScript payloads via the 'question_title' parameter. The injected script executes in the browser of any user who subsequently views a page containing the poisoned quiz, enabling session hijacking, credential harvesting, or unauthorized administrative actions. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; however, the scope change noted in the CVSS vector underscores that impact crosses the boundary from the injecting contributor into every visiting user's browser context.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
SQL Injection in the Fullscreen Galleria WordPress plugin (all versions through 1.6.12) allows authenticated attackers holding contributor-level access or higher to append arbitrary SQL subqueries via an unsanitized 'href' attribute in post content, enabling full read-access to the WordPress database. Multiple vulnerable sinks in galleria-fs.php (lines 68, 74, 146, 1074, 1078) were identified and disclosed by Wordfence; upstream fix commits have been published to the WordPress plugin repository. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this at moderate real-world priority, elevated for sites with open contributor registration.
Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary shortcode execution in ProfilePress (WordPress plugin) versions through 4.16.19 permits authenticated attackers holding only subscriber-level accounts to inject and run arbitrary WordPress shortcodes within the site context. The plugin's partial mitigation - applying strip_shortcodes() to [profile-first-name] and [profile-last-name] fields - is bypassed via at least three confirmed paths: the [profile-display-name format="first_last_names"] render chain, the [profile-bio] field (which re-fetches raw user_description meta, bypassing the sanitized value), and the double-bracket escape sequence [[tag]] that passes through strip_shortcodes() unmodified but is resolved by the outer do_shortcode() call. No public exploit code has been confirmed at time of analysis, but the low authentication bar (self-registration is the plugin's core use case) and three documented bypass vectors make this a meaningful risk on open-registration membership sites.
Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.