Wordpress Plugin
Monthly
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
Stored Cross-Site Scripting in the Weblizar Admin Custom Login WordPress plugin (all versions ≤ 3.6.4) allows an authenticated administrator to inject persistent malicious scripts into the WordPress login page, which then execute in the browsers of any user who visits it - including unauthenticated visitors. The vulnerability is conditionally exploitable: it only manifests on WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly revoked from administrators, both non-default configurations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.
Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.
Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.
Broken access control in the WPEverest User Registration WordPress plugin (versions ≤5.2.6) permits unauthenticated remote attackers to bypass authorization checks and perform unauthorized actions within the registration subsystem, yielding limited integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no authentication, no user interaction, and no special configuration, though impact is constrained to integrity modifications with no confidentiality or availability effect. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in InstaWP Connect (WordPress plugin) versions up to and including 0.1.3.7 permits unauthenticated remote attackers to perform restricted actions without authorization, resulting in limited integrity impact on the target WordPress installation. The root cause is CWE-862 (Missing Authorization), where one or more plugin endpoints fail to verify the requester's permissions before executing sensitive operations. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and absence of authentication requirements lower the exploitation bar considerably.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in Revolut Gateway for WooCommerce allows unauthenticated remote attackers to reach restricted plugin endpoints and read protected data, yielding low confidentiality exposure with no integrity or availability impact. All plugin versions below 4.22.10 on WordPress/WooCommerce installations are affected. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Featured Image from URL WordPress plugin (versions up to and including 5.3.3) allows authenticated Contributors to inject malicious scripts into pages viewed by higher-privileged users such as editors or administrators. The vulnerability resides in insufficient output encoding of user-supplied URL input used for featured images, giving attackers a foothold for privilege escalation or session hijacking within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Contributor-level access requirement makes this realistic in any multi-author WordPress site.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the Anti Spam and list cleaner - AcyChecker WordPress plugin (versions <= 2.0.0) allows attackers to access or invoke restricted plugin functionality without proper authorization. Reported by Patchstack and tracked as EUVD-2026-57901, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX handlers. Depending on the exposed functionality - which can include email list management, spam rule configuration, or subscriber data operations - an attacker could read, modify, or degrade plugin-controlled data. No public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in WpBookingly (WordPress plugin by MagePeople Team, versions ≤ 1.3.2) allows a low-privileged attacker - such as an external customer submitting a booking request - to inject malicious scripts into customer-facing input fields that are later rendered unsanitized in the WordPress admin panel. When an administrator views the poisoned booking data, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, low-complexity attack surface makes this a meaningful risk for any site accepting public booking submissions.
Broken access control in Contact Form 7 - PayPal & Stripe Add-on versions 2.5.1 and below allows unauthenticated remote attackers to invoke privileged plugin functionality without authorization, enabling unauthorized modification of plugin state or disruption of payment form behavior. Discovered and disclosed by Patchstack (ENISA EUVD-2026-57898), the flaw is rooted in CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute sensitive actions without verifying caller permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Server-Side Request Forgery in Vehica Core WordPress plugin (versions ≤ 1.0.104) allows an authenticated subscriber-level user to induce the server into making arbitrary HTTP requests to internal or external endpoints, potentially exposing internal network topology or services not intended to be reachable from the internet. The vulnerability carries a CVSS 3.1 score of 6.0 with a scope change (S:C), indicating that exploitation can affect systems beyond the vulnerable WordPress installation itself. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.
Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials or user interaction are required, allowing any remote party to interact with privileged plugin endpoints on affected WordPress installations. The impact is limited to partial confidentiality and integrity compromise - consistent with unauthorized read or write access to internal link data - with no availability impact identified. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the AI for SEO WordPress plugin (versions ≤ 2.4.2) permits unauthenticated remote attackers to invoke restricted plugin functionality without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position - any internet-facing WordPress site running the affected plugin is reachable. Impact is bounded to partial integrity and availability disruption (I:L/A:L) with no confidentiality exposure, suggesting unauthorized manipulation of plugin operations rather than data exfiltration. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Profile Extra Fields by BestWebSoft WordPress plugin (versions ≤1.3.4) allows an authenticated subscriber-level user to inject arbitrary JavaScript into custom profile fields, which then executes in the browser of any higher-privileged user who views the affected profile - including site administrators. The scope-changed impact (S:C) is the key risk multiplier: a minimally privileged attacker can potentially hijack admin sessions or perform unauthorized actions on behalf of victims. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the ReactPress WordPress plugin (versions up to and including 3.4.0) permits subscriber-level authenticated users to perform privileged operations that should be restricted to higher-capability roles. The CVSS vector (S:C) indicates the flaw's impact extends beyond the plugin's own trust boundary, potentially affecting broader WordPress site resources such as content or configuration. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in WP Social Avatar WordPress plugin (versions ≤ 1.5) exposes one or more plugin endpoints to unauthenticated remote attackers, who can perform restricted operations without valid credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with no credentials or user interaction required, with consequences limited to low-severity integrity and availability impact and no confidentiality exposure. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Broken access control in the Secure Card Gateway for ePay Paycenter WordPress plugin (versions ≤ 1.0.32) enables remote unauthenticated attackers to bypass authorization checks and invoke privileged plugin operations without supplying any credential. Reported by Patchstack and classified as CWE-862 (Missing Authorization), the flaw carries a CVSS 3.1 score of 6.5 with a fully network-accessible, zero-privilege, zero-interaction attack vector. No active exploitation has been confirmed - this CVE does not appear in the CISA KEV catalog - and no public proof-of-concept code has been identified at time of analysis.
Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.
Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote attackers without any credentials to reference and manipulate internal objects by supplying attacker-controlled identifier values, resulting in unauthorized modification or disruption of affiliate link data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default plugin installations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement lower the barrier to opportunistic abuse.
Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated subscriber-level users to access restricted functionality or data beyond their intended authorization scope. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged authenticated users to bypass access controls and retrieve sensitive information, as reflected by the High confidentiality impact in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw makes it straightforward to exploit for any registered site user.
Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.
Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized `ppwp` shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Authorization bypass in the Stream - Activity Log & Audit Trail WordPress plugin (versions through 4.2.0) exposes the full site audit trail to any authenticated user holding a subscriber-level account or higher. The flaw resides in the plugin's Heartbeat API live-update handler, which returns activity records without verifying the requesting user holds the privileges required to view them (CWE-862). No public exploit or CISA KEV listing exists at time of analysis, but the low exploitation bar - any registered user account suffices - makes this a credible insider or low-effort attacker risk on sites with open registration.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated broken access control in the Profile Builder WordPress plugin (versions up to and including 3.16.5) allows remote, unauthenticated attackers to perform unauthorized write operations against plugin functionality - bypassing intended access restrictions without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms full network exploitability with no prerequisites, though impact is limited to low-severity integrity modifications with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. No public exploit code and no CISA KEV listing are identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Colissimo Officiel WooCommerce shipping plugin (≤2.10.0) enables authenticated low-privileged customers to access shipping or order objects belonging to other users by manipulating controllable object references in plugin requests. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, low-complexity exploitation limited to authenticated WooCommerce customer accounts, with impact confined to limited confidentiality exposure of delivery data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Export Import Menus WordPress plugin (versions up to and including 1.9.2) allows remote, unauthenticated attackers to access sensitive information by invoking the plugin's export functionality without any credentials. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin returns sensitive data in its HTTP responses to unauthenticated requests. No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.
Broken access control in the IT-Recht Kanzlei Legal Text Connector WordPress plugin (versions <= 1.0.13) allows unauthenticated remote attackers to perform unauthorized actions against the plugin's endpoints, resulting in low-severity integrity and availability impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify that a requestor has permission before executing sensitive operations. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken Authentication in Gutena Forms WordPress plugin (versions <= 1.9.0) allows unauthenticated remote attackers to bypass authentication controls, resulting in limited integrity and availability impacts against form configurations or submissions. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and was reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and lack of authentication requirements make it straightforward to attempt against any exposed WordPress installation running the affected plugin.
CAPTCHA bypass in Element Pack Elementor Addons (WordPress plugin by BDThemes) versions up to and including 8.7.13 allows unauthenticated remote attackers to circumvent CAPTCHA verification on protected forms. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables automated or scripted clients to submit forms without completing the CAPTCHA challenge, undermining bot-protection controls. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this Medium (5.3) with integrity-only impact.
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.
Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.
Broken access control in Ultimate Store Kit Elementor Addons versions up to and including 3.0.5 allows unauthenticated remote attackers to perform unauthorized read and write operations against WordPress store functionality. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX actions, enabling bypass of intended access restrictions without any credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, AC:L) makes opportunistic exploitation straightforward once the specific vulnerable endpoint is identified.
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.
Unauthorized configuration takeover in the Udimi Tools WordPress plugin (≤ 3.2) is possible for any subscriber-level authenticated user due to missing capability checks on both the `ajax_disconnect()` and `ajax_connect()` AJAX handlers. An attacker with a valid low-privilege WordPress account can wipe the site's Udimi API key and connected account settings, then replace them with attacker-controlled credentials - effectively hijacking the site's Udimi solo-ad integration and redirecting lead tracking data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, allowing any authenticated user with Subscriber-level access to publish arbitrary posts of the custom type `xpro_content` via a missing capability check on the `get_menu_content_editor()` AJAX handler. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam campaigns, and database pollution against any WordPress site running the plugin. No public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication barrier (any registered user) lowers the practical difficulty of abuse.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
Stored Cross-Site Scripting in the Weblizar Admin Custom Login WordPress plugin (all versions ≤ 3.6.4) allows an authenticated administrator to inject persistent malicious scripts into the WordPress login page, which then execute in the browsers of any user who visits it - including unauthenticated visitors. The vulnerability is conditionally exploitable: it only manifests on WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly revoked from administrators, both non-default configurations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.
Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.
Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.
SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions through 3.2.36) permits unauthenticated remote attackers to write attacker-controlled payment status and transaction data directly into the plugin's payments database table, bypassing any payment gateway verification. This enables fraudulent marking of reservations as paid or completed, cancellation of legitimate customer payments, and dispatch of transactional booking confirmation emails to arbitrary parties. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.
Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.
SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.
Cross-site request forgery in the Astro Booking Engine WordPress plugin (all versions ≤ 1.4.0) enables unauthenticated remote attackers to wipe all plugin settings by tricking an authenticated administrator into following a malicious link. The root cause is missing nonce validation on the options-deletion handler - a textbook CWE-352 pattern - allowing the plugin to execute state-changing operations without confirming request origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified, positioning this as a legitimate remediation item rather than an emergency response priority.
Broken access control in the WPEverest User Registration WordPress plugin (versions ≤5.2.6) permits unauthenticated remote attackers to bypass authorization checks and perform unauthorized actions within the registration subsystem, yielding limited integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no authentication, no user interaction, and no special configuration, though impact is constrained to integrity modifications with no confidentiality or availability effect. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in InstaWP Connect (WordPress plugin) versions up to and including 0.1.3.7 permits unauthenticated remote attackers to perform restricted actions without authorization, resulting in limited integrity impact on the target WordPress installation. The root cause is CWE-862 (Missing Authorization), where one or more plugin endpoints fail to verify the requester's permissions before executing sensitive operations. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and absence of authentication requirements lower the exploitation bar considerably.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in Revolut Gateway for WooCommerce allows unauthenticated remote attackers to reach restricted plugin endpoints and read protected data, yielding low confidentiality exposure with no integrity or availability impact. All plugin versions below 4.22.10 on WordPress/WooCommerce installations are affected. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Featured Image from URL WordPress plugin (versions up to and including 5.3.3) allows authenticated Contributors to inject malicious scripts into pages viewed by higher-privileged users such as editors or administrators. The vulnerability resides in insufficient output encoding of user-supplied URL input used for featured images, giving attackers a foothold for privilege escalation or session hijacking within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Contributor-level access requirement makes this realistic in any multi-author WordPress site.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the Anti Spam and list cleaner - AcyChecker WordPress plugin (versions <= 2.0.0) allows attackers to access or invoke restricted plugin functionality without proper authorization. Reported by Patchstack and tracked as EUVD-2026-57901, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX handlers. Depending on the exposed functionality - which can include email list management, spam rule configuration, or subscriber data operations - an attacker could read, modify, or degrade plugin-controlled data. No public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in WpBookingly (WordPress plugin by MagePeople Team, versions ≤ 1.3.2) allows a low-privileged attacker - such as an external customer submitting a booking request - to inject malicious scripts into customer-facing input fields that are later rendered unsanitized in the WordPress admin panel. When an administrator views the poisoned booking data, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, low-complexity attack surface makes this a meaningful risk for any site accepting public booking submissions.
Broken access control in Contact Form 7 - PayPal & Stripe Add-on versions 2.5.1 and below allows unauthenticated remote attackers to invoke privileged plugin functionality without authorization, enabling unauthorized modification of plugin state or disruption of payment form behavior. Discovered and disclosed by Patchstack (ENISA EUVD-2026-57898), the flaw is rooted in CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute sensitive actions without verifying caller permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Server-Side Request Forgery in Vehica Core WordPress plugin (versions ≤ 1.0.104) allows an authenticated subscriber-level user to induce the server into making arbitrary HTTP requests to internal or external endpoints, potentially exposing internal network topology or services not intended to be reachable from the internet. The vulnerability carries a CVSS 3.1 score of 6.0 with a scope change (S:C), indicating that exploitation can affect systems beyond the vulnerable WordPress installation itself. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.
Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.
Broken access control in Internal Link Optimiser (WordPress plugin by Toast Plugins) versions up to and including 5.2.7 exposes restricted plugin functionality to unauthenticated network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no credentials or user interaction are required, allowing any remote party to interact with privileged plugin endpoints on affected WordPress installations. The impact is limited to partial confidentiality and integrity compromise - consistent with unauthorized read or write access to internal link data - with no availability impact identified. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the AI for SEO WordPress plugin (versions ≤ 2.4.2) permits unauthenticated remote attackers to invoke restricted plugin functionality without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position - any internet-facing WordPress site running the affected plugin is reachable. Impact is bounded to partial integrity and availability disruption (I:L/A:L) with no confidentiality exposure, suggesting unauthorized manipulation of plugin operations rather than data exfiltration. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Profile Extra Fields by BestWebSoft WordPress plugin (versions ≤1.3.4) allows an authenticated subscriber-level user to inject arbitrary JavaScript into custom profile fields, which then executes in the browser of any higher-privileged user who views the affected profile - including site administrators. The scope-changed impact (S:C) is the key risk multiplier: a minimally privileged attacker can potentially hijack admin sessions or perform unauthorized actions on behalf of victims. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the ReactPress WordPress plugin (versions up to and including 3.4.0) permits subscriber-level authenticated users to perform privileged operations that should be restricted to higher-capability roles. The CVSS vector (S:C) indicates the flaw's impact extends beyond the plugin's own trust boundary, potentially affecting broader WordPress site resources such as content or configuration. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in WP Social Avatar WordPress plugin (versions ≤ 1.5) exposes one or more plugin endpoints to unauthenticated remote attackers, who can perform restricted operations without valid credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with no credentials or user interaction required, with consequences limited to low-severity integrity and availability impact and no confidentiality exposure. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Broken access control in the Secure Card Gateway for ePay Paycenter WordPress plugin (versions ≤ 1.0.32) enables remote unauthenticated attackers to bypass authorization checks and invoke privileged plugin operations without supplying any credential. Reported by Patchstack and classified as CWE-862 (Missing Authorization), the flaw carries a CVSS 3.1 score of 6.5 with a fully network-accessible, zero-privilege, zero-interaction attack vector. No active exploitation has been confirmed - this CVE does not appear in the CISA KEV catalog - and no public proof-of-concept code has been identified at time of analysis.
Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in the AcyMailing SMTP Newsletter WordPress plugin (versions <= 10.11.1) permits subscriber-level users to access restricted functionality reserved for higher-privileged roles. The flaw, rooted in missing authorization checks (CWE-862), allows a low-privileged but authenticated WordPress user to read sensitive newsletter data - including subscriber lists, campaign details, or configuration - that should require administrator or editor access. No public exploit or active exploitation via CISA KEV is confirmed at time of analysis, though Patchstack has documented and disclosed the vulnerability.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.
Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote attackers without any credentials to reference and manipulate internal objects by supplying attacker-controlled identifier values, resulting in unauthorized modification or disruption of affiliate link data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default plugin installations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement lower the barrier to opportunistic abuse.
Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated subscriber-level users to access restricted functionality or data beyond their intended authorization scope. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged authenticated users to bypass access controls and retrieve sensitive information, as reflected by the High confidentiality impact in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw makes it straightforward to exploit for any registered site user.
Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.
Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized `ppwp` shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in the WP Umbrella WordPress plugin (versions through 2.26.2) enables a remote unauthenticated attacker to trigger state-changing actions on behalf of an authenticated WordPress administrator. Exploitation requires social engineering the victim into visiting or loading attacker-controlled content while logged in, resulting in low-impact integrity and availability consequences per the CVSS vector. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Authorization bypass in the Stream - Activity Log & Audit Trail WordPress plugin (versions through 4.2.0) exposes the full site audit trail to any authenticated user holding a subscriber-level account or higher. The flaw resides in the plugin's Heartbeat API live-update handler, which returns activity records without verifying the requesting user holds the privileges required to view them (CWE-862). No public exploit or CISA KEV listing exists at time of analysis, but the low exploitation bar - any registered user account suffices - makes this a credible insider or low-effort attacker risk on sites with open registration.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated broken access control in the Profile Builder WordPress plugin (versions up to and including 3.16.5) allows remote, unauthenticated attackers to perform unauthorized write operations against plugin functionality - bypassing intended access restrictions without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms full network exploitability with no prerequisites, though impact is limited to low-severity integrity modifications with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Dokan WordPress multi-vendor marketplace plugin (all versions through 5.0.10) allows network-accessible exploitation of its custom role permission system, enabling unauthorized integrity-affecting actions. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to verify whether a requester holds the appropriate capability before executing role-gated operations. No public exploit code or CISA KEV listing exists at time of analysis; CVSS rates this medium severity (5.3), with the original vector asserting no privileges required and no user interaction.
Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. No public exploit code and no CISA KEV listing are identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Colissimo Officiel WooCommerce shipping plugin (≤2.10.0) enables authenticated low-privileged customers to access shipping or order objects belonging to other users by manipulating controllable object references in plugin requests. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, low-complexity exploitation limited to authenticated WooCommerce customer accounts, with impact confined to limited confidentiality exposure of delivery data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Cross-Site Request Forgery in Plugins Garbage Collector (Database Cleanup) plugin for WordPress version 0.14 and earlier enables an unauthenticated remote attacker to perform unauthorized administrative database operations by tricking an authenticated WordPress administrator into visiting a malicious page. The CVSS vector (PR:N/UI:R/I:H) confirms the attacker requires no privileges but must engineer social interaction with a privileged user, yielding high integrity impact - specifically, the ability to trigger plugin or database cleanup actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Export Import Menus WordPress plugin (versions up to and including 1.9.2) allows remote, unauthenticated attackers to access sensitive information by invoking the plugin's export functionality without any credentials. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin returns sensitive data in its HTTP responses to unauthenticated requests. No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Broken access control in the Advanced Custom Fields: Font Awesome Field WordPress plugin (versions up to and including 6.1.1) permits contributor-level authenticated users to perform privileged operations beyond their intended role. The CWE-862 root cause indicates the plugin fails to enforce proper authorization checks before executing certain functionality, allowing lower-privileged users to read data or invoke actions restricted to higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector and low privilege requirement make this exploitable by any user with a contributor account on affected WordPress installations.
Broken access control in the IT-Recht Kanzlei Legal Text Connector WordPress plugin (versions <= 1.0.13) allows unauthenticated remote attackers to perform unauthorized actions against the plugin's endpoints, resulting in low-severity integrity and availability impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify that a requestor has permission before executing sensitive operations. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken Authentication in Gutena Forms WordPress plugin (versions <= 1.9.0) allows unauthenticated remote attackers to bypass authentication controls, resulting in limited integrity and availability impacts against form configurations or submissions. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and was reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and lack of authentication requirements make it straightforward to attempt against any exposed WordPress installation running the affected plugin.
CAPTCHA bypass in Element Pack Elementor Addons (WordPress plugin by BDThemes) versions up to and including 8.7.13 allows unauthenticated remote attackers to circumvent CAPTCHA verification on protected forms. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables automated or scripted clients to submit forms without completing the CAPTCHA challenge, undermining bot-protection controls. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this Medium (5.3) with integrity-only impact.
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated IDOR in Mercado Pago payments for WooCommerce plugin (≤8.9.0) exposes order or payment objects to remote attackers without any authentication requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation at low complexity with no credentials needed, resulting in limited confidentiality breach (C:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point makes enumeration of payment and order references realistic for opportunistic actors targeting WooCommerce storefronts.
Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.
Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.
Broken access control in Ultimate Store Kit Elementor Addons versions up to and including 3.0.5 allows unauthenticated remote attackers to perform unauthorized read and write operations against WordPress store functionality. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX actions, enabling bypass of intended access restrictions without any credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, AC:L) makes opportunistic exploitation straightforward once the specific vulnerable endpoint is identified.
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Authorization bypass in the Ad Inserter WordPress plugin (all versions through 2.8.16) allows unauthenticated remote attackers to read ad block contents that administrators have restricted to administrator-only visibility, by invoking the unguarded `ai_ajax` AJAX function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial unauthenticated network exploitation with no user interaction required. No public exploit has been identified at time of analysis, but two upstream WordPress plugin repository changesets (3583409, 3567905) indicate a fix has been committed.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.
Unauthorized configuration takeover in the Udimi Tools WordPress plugin (≤ 3.2) is possible for any subscriber-level authenticated user due to missing capability checks on both the `ajax_disconnect()` and `ajax_connect()` AJAX handlers. An attacker with a valid low-privilege WordPress account can wipe the site's Udimi API key and connected account settings, then replace them with attacker-controlled credentials - effectively hijacking the site's Udimi solo-ad integration and redirecting lead tracking data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.
Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.
Unauthorized post creation in Xpro Addons - 140+ Widgets for Elementor (WordPress) affects all versions through 1.5.1, allowing any authenticated user with Subscriber-level access to publish arbitrary posts of the custom type `xpro_content` via a missing capability check on the `get_menu_content_editor()` AJAX handler. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam campaigns, and database pollution against any WordPress site running the plugin. No public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication barrier (any registered user) lowers the practical difficulty of abuse.