Wordpress Plugin
Monthly
Stored XSS in SKT Skill Bar WordPress plugin (all versions up to and including 2.6) permits authenticated Contributor-level attackers to persist arbitrary JavaScript into any post or page by exploiting unsanitized handling of the `chart_size` attribute in the `skillwrapper` shortcode. The attribute value is concatenated directly into an inline `<style>` block without sanitization or output escaping, enabling CSS-context breakout and script injection that executes against every subsequent visitor. No public exploit code or CISA KEV listing was identified at time of analysis, though the vulnerable code is publicly browsable in the WordPress plugin repository, lowering the barrier to exploit development.
Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.
Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.
Insecure Direct Object Reference in the Groundhogg WordPress plugin (all versions through 4.5.2) allows authenticated users holding the view_contacts capability - most notably the built-in Sales Rep role - to enumerate and retrieve any contact record site-wide via the REST API, bypassing the intended ownership restriction that should limit them to their own assigned contacts. The GET /wp-json/gh/v4/contacts/<id> endpoint performs only a role-level capability check and accepts sequential integer IDs, meaning a Sales Rep can trivially iterate through all contact IDs and extract PII, contact metadata, owner identifiers, admin edit URLs, and - for contacts linked to a WordPress account - that user's full capability set. No public exploit code or active exploitation has been identified at time of analysis, but the attack is low-complexity for any attacker who can register or obtain a Sales Rep account.
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.
Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the `CacheExtractPreparePageParams()` function uses PHP's loose `!=` operator to validate the nonce, which allows a JSON-decoded boolean `true` to compare as equal to any non-empty HMAC string, and the `_CbContentFinishSkip()` function then concatenates the attacker-controlled `selfTest` field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.
Unauthenticated SSRF-adjacent resource abuse in Layouts for WPBakery (all versions ≤ 1.1.3) allows any remote attacker to force the WordPress host to issue unlimited outbound HTTP requests to the plugin vendor's external REST API and write the decoded JSON responses directly into the site's wp_options database table. The missing capability check on the wp_ajax_nopriv_handle_sync action (CWE-862) exposes this endpoint to every unauthenticated client with no nonce verification or rate limiting in place. This vulnerability is not listed in CISA KEV and no public exploit code has been identified, but the trivially low attack complexity - unauthenticated, network-reachable, zero prerequisites - makes availability abuse a realistic and automatable threat.
Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.
SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.
SQL injection in the WP ERP WordPress plugin (all versions through 1.17.4) allows authenticated CRM Agent-role users to extract arbitrary data from the WordPress database by supplying a crafted 'erpadvancefilter' parameter to the CRM AJAX handler. The root flaw is a sanitization gap: sanitize_text_field strips HTML but preserves single quotes, which are then interpolated verbatim into a single-quoted SQL WHERE clause inside erp_crm_contact_advance_filter() before execution via $wpdb->get_results(), bypassing WordPress's parameterized query protections entirely. No public exploit has been identified at time of analysis, but the vulnerable code paths are fully documented in WordPress plugin trac source references provided by Wordfence.
Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's `shouttext` POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a `<textarea>` via `printf('%s', ...)`. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but a remediation commit (changeset 3538628) has been pushed to the plugin trunk.
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the `exad_infobox_image` parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Wordfence's changeset reference suggests source-code-level details are publicly accessible.
Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Sensitive WooCommerce order data exposure in the PixelYourSite WordPress plugin (all versions through 11.2.1) allows unauthenticated remote attackers to retrieve full purchase metadata - product names, quantities, per-item prices, order totals, currency, and transaction IDs - for any order by supplying an arbitrary or invalid order key alongside a known order ID. The plugin's getWooPurchaseEventParams function resolves orders solely from the URL path order ID without validating the accompanying key, then emits the complete woo_purchase tracking payload directly into rendered page HTML via the pysOptions JavaScript object across all three supported integrations (Facebook Pixel, Google Analytics, and Google Tag Manager). No public exploit has been identified at time of analysis, but because WooCommerce order IDs are sequential integers by default, mass enumeration of the entire order history requires only a trivial HTTP loop.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.
Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.
SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.
Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Stored Cross-Site Scripting in the GenerateBlocks WordPress plugin (all versions through 2.3.0) allows authenticated contributors to permanently inject malicious JavaScript into published pages by exploiting unsanitized dynamic tag rendering in non-URL HTML attributes. An attacker with contributor-level WordPress access can chain a dynamic tag placeholder (e.g., {{post_meta key:...}}) in an element attribute with a crafted post meta value containing attribute-breaking syntax, causing script execution in the browser of any subsequent visitor. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the detailed technical disclosure from Wordfence lowers the bar for independent exploitation.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Second-order SQL injection in the Icegram Engage WordPress plugin (all versions through 3.1.42) allows authenticated attackers holding sufficient WordPress role privileges to extract arbitrary data from the site database across two deliberate HTTP requests. A crafted `messages[][id]` value is first persisted to WordPress post meta through the `save_campaign_preview()` AJAX action, then later interpolated unescaped into a SQL `IN()` clause inside `get_message_data()` during a subsequent preview request - bypassing `$wpdb->prepare()` entirely. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported the issue with a CVSS 6.5 base score reflecting high confidentiality impact against an unchanged scope.
Stored Cross-Site Scripting in the Easy Property Listings WordPress plugin (all versions up to and including 3.5.24) allows any authenticated subscriber-level user to permanently inject malicious JavaScript through the 'facebook' User Contact Method profile field. The injected payload persists in the WordPress database and executes automatically in the browser of any site visitor who views a property listing page rendering the compromised author profile, enabling session hijacking, credential theft, or administrative account takeover. No KEV listing or confirmed public exploit code was identified in the available input data; a fix changeset exists in the WordPress plugin repository but an exact patched release version is not confirmed from the provided data.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.
Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected `kr_mr_store_settings()` function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
Cross-site scripting in the Link Library WordPress plugin (versions before 7.9.4) allows unauthenticated network-based attackers to inject malicious JavaScript that executes in the context of other users' browsers. The CVSS 4.0 vector assigns High subsequent-system impacts (SC:H/SI:H/SA:H), indicating exploitation could compromise visiting administrators and cascade to full WordPress site control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Tenable reported the finding (TRA-2026-52) and a patched release (7.9.4) is available.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.
Missing authorization in the Storegrowth Sales Booster plugin for WordPress ≤2.1.0 allows unauthenticated attackers to modify the BOGO category-message configuration. The vulnerability arises from an AJAX handler that only verifies a nonce value publicly exposed on every frontend page, bypassing capability checks. There is no evidence of active exploitation or publicly available exploit code, and impact is limited to low integrity loss with no confidentiality or availability impact.
Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements.
Missing authorization in the WPBot WordPress plugin allows unauthenticated attackers to send arbitrary emails from the site's domain. Versions up to 8.5.9 are vulnerable via the wpcs_send_email() AJAX handler, which lacks nonce verification and capability checks. No active exploitation has been identified, but the flaw can be easily automated for spam or phishing campaigns.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with `__return_true`, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.
Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.
Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Stored cross-site scripting (XSS) in the WooCommerce Checkout Manager plugin allows authenticated shop managers to inject arbitrary JavaScript into checkout field settings. When another administrator views the affected configuration, the malicious script executes in their browser session, potentially leading to session hijacking or unauthorized actions. No active exploitation has been reported, and the vulnerability is not listed as known exploited by CISA.
Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Broken access control in YayPricing ≤ 3.5.6 allows authenticated subscribers to modify pricing data or cause service disruption. The vulnerability, rated medium severity (CVSS 5.4), stems from missing authorization checks in an endpoint that should be restricted to higher-privilege roles. No public exploit code or active exploitation is known at the time of analysis.
Information disclosure in Exclusive Addons Elementor versions up to 2.8.0 allows unauthenticated remote attackers to access sensitive data. The vulnerability is classified as CWE-497 exposure of sensitive information. No public exploit code or active exploitation has been reported at time of analysis.
Server-side request forgery (SSRF) in the Feedzy WordPress plugin version 5.2.4 and below allows authenticated contributors to craft malicious RSS feed URLs, leading to unauthorized requests to internal or external resources. This could disclose limited internal service information or allow low-integrity modifications, but exploitation requires high attack complexity and contributor-level access. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Stored cross-site scripting in the Photonic Gallery & Lightbox plugin for WordPress allows authenticated attackers with Contributor-level privileges to inject arbitrary web scripts. When an administrator or other higher-privilege user views a crafted gallery or album configuration, the malicious script executes in their browser, potentially leading to session hijacking or account takeover. This affects all versions up to and including 3.33.
Stored cross-site scripting in the Location Weather WordPress plugin (≤ 3.0.6) allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When a higher-privileged user (such as an administrator) views the malicious content, the script executes in that user’s browser, potentially leading to session hijacking, site defacement, or other client-side attacks. No active exploitation or public proof-of-concept is reported, and the EPSS probability is not available.
Stored XSS in SKT Skill Bar WordPress plugin (all versions up to and including 2.6) permits authenticated Contributor-level attackers to persist arbitrary JavaScript into any post or page by exploiting unsanitized handling of the `chart_size` attribute in the `skillwrapper` shortcode. The attribute value is concatenated directly into an inline `<style>` block without sanitization or output escaping, enabling CSS-context breakout and script injection that executes against every subsequent visitor. No public exploit code or CISA KEV listing was identified at time of analysis, though the vulnerable code is publicly browsable in the WordPress plugin repository, lowering the barrier to exploit development.
Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.
SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.
Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.
Insecure Direct Object Reference in the Groundhogg WordPress plugin (all versions through 4.5.2) allows authenticated users holding the view_contacts capability - most notably the built-in Sales Rep role - to enumerate and retrieve any contact record site-wide via the REST API, bypassing the intended ownership restriction that should limit them to their own assigned contacts. The GET /wp-json/gh/v4/contacts/<id> endpoint performs only a role-level capability check and accepts sequential integer IDs, meaning a Sales Rep can trivially iterate through all contact IDs and extract PII, contact metadata, owner identifiers, admin edit URLs, and - for contacts linked to a WordPress account - that user's full capability set. No public exploit code or active exploitation has been identified at time of analysis, but the attack is low-complexity for any attacker who can register or obtain a Sales Rep account.
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.
Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the `CacheExtractPreparePageParams()` function uses PHP's loose `!=` operator to validate the nonce, which allows a JSON-decoded boolean `true` to compare as equal to any non-empty HMAC string, and the `_CbContentFinishSkip()` function then concatenates the attacker-controlled `selfTest` field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.
Unauthenticated SSRF-adjacent resource abuse in Layouts for WPBakery (all versions ≤ 1.1.3) allows any remote attacker to force the WordPress host to issue unlimited outbound HTTP requests to the plugin vendor's external REST API and write the decoded JSON responses directly into the site's wp_options database table. The missing capability check on the wp_ajax_nopriv_handle_sync action (CWE-862) exposes this endpoint to every unauthenticated client with no nonce verification or rate limiting in place. This vulnerability is not listed in CISA KEV and no public exploit code has been identified, but the trivially low attack complexity - unauthenticated, network-reachable, zero prerequisites - makes availability abuse a realistic and automatable threat.
Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.
SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.
SQL injection in the WP ERP WordPress plugin (all versions through 1.17.4) allows authenticated CRM Agent-role users to extract arbitrary data from the WordPress database by supplying a crafted 'erpadvancefilter' parameter to the CRM AJAX handler. The root flaw is a sanitization gap: sanitize_text_field strips HTML but preserves single quotes, which are then interpolated verbatim into a single-quoted SQL WHERE clause inside erp_crm_contact_advance_filter() before execution via $wpdb->get_results(), bypassing WordPress's parameterized query protections entirely. No public exploit has been identified at time of analysis, but the vulnerable code paths are fully documented in WordPress plugin trac source references provided by Wordfence.
Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's `shouttext` POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a `<textarea>` via `printf('%s', ...)`. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but a remediation commit (changeset 3538628) has been pushed to the plugin trunk.
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the `exad_infobox_image` parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Wordfence's changeset reference suggests source-code-level details are publicly accessible.
Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.
Sensitive WooCommerce order data exposure in the PixelYourSite WordPress plugin (all versions through 11.2.1) allows unauthenticated remote attackers to retrieve full purchase metadata - product names, quantities, per-item prices, order totals, currency, and transaction IDs - for any order by supplying an arbitrary or invalid order key alongside a known order ID. The plugin's getWooPurchaseEventParams function resolves orders solely from the URL path order ID without validating the accompanying key, then emits the complete woo_purchase tracking payload directly into rendered page HTML via the pysOptions JavaScript object across all three supported integrations (Facebook Pixel, Google Analytics, and Google Tag Manager). No public exploit has been identified at time of analysis, but because WooCommerce order IDs are sequential integers by default, mass enumeration of the entire order history requires only a trivial HTTP loop.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.
Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.
SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.
Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.
Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.
Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Stored Cross-Site Scripting in the GenerateBlocks WordPress plugin (all versions through 2.3.0) allows authenticated contributors to permanently inject malicious JavaScript into published pages by exploiting unsanitized dynamic tag rendering in non-URL HTML attributes. An attacker with contributor-level WordPress access can chain a dynamic tag placeholder (e.g., {{post_meta key:...}}) in an element attribute with a crafted post meta value containing attribute-breaking syntax, causing script execution in the browser of any subsequent visitor. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the detailed technical disclosure from Wordfence lowers the bar for independent exploitation.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Second-order SQL injection in the Icegram Engage WordPress plugin (all versions through 3.1.42) allows authenticated attackers holding sufficient WordPress role privileges to extract arbitrary data from the site database across two deliberate HTTP requests. A crafted `messages[][id]` value is first persisted to WordPress post meta through the `save_campaign_preview()` AJAX action, then later interpolated unescaped into a SQL `IN()` clause inside `get_message_data()` during a subsequent preview request - bypassing `$wpdb->prepare()` entirely. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported the issue with a CVSS 6.5 base score reflecting high confidentiality impact against an unchanged scope.
Stored Cross-Site Scripting in the Easy Property Listings WordPress plugin (all versions up to and including 3.5.24) allows any authenticated subscriber-level user to permanently inject malicious JavaScript through the 'facebook' User Contact Method profile field. The injected payload persists in the WordPress database and executes automatically in the browser of any site visitor who views a property listing page rendering the compromised author profile, enabling session hijacking, credential theft, or administrative account takeover. No KEV listing or confirmed public exploit code was identified in the available input data; a fix changeset exists in the WordPress plugin repository but an exact patched release version is not confirmed from the provided data.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.
Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.
Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.
Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected `kr_mr_store_settings()` function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
Cross-site scripting in the Link Library WordPress plugin (versions before 7.9.4) allows unauthenticated network-based attackers to inject malicious JavaScript that executes in the context of other users' browsers. The CVSS 4.0 vector assigns High subsequent-system impacts (SC:H/SI:H/SA:H), indicating exploitation could compromise visiting administrators and cascade to full WordPress site control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Tenable reported the finding (TRA-2026-52) and a patched release (7.9.4) is available.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.
Missing authorization in the Storegrowth Sales Booster plugin for WordPress ≤2.1.0 allows unauthenticated attackers to modify the BOGO category-message configuration. The vulnerability arises from an AJAX handler that only verifies a nonce value publicly exposed on every frontend page, bypassing capability checks. There is no evidence of active exploitation or publicly available exploit code, and impact is limited to low integrity loss with no confidentiality or availability impact.
Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements.
Missing authorization in the WPBot WordPress plugin allows unauthenticated attackers to send arbitrary emails from the site's domain. Versions up to 8.5.9 are vulnerable via the wpcs_send_email() AJAX handler, which lacks nonce verification and capability checks. No active exploitation has been identified, but the flaw can be easily automated for spam or phishing campaigns.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Unauthenticated arbitrary file copy in the WordPress plugin Demi - One Click Demo Import, Backup & Site Migration (all versions up to and including 0.0.8) lets a remote attacker redirect file copies to a destination of their choosing inside the server filesystem, potentially exposing or relocating sensitive files. The flaw is conditional: the plugin only writes its .restore_key and .restore_step_token secrets into the world-readable wp-content/uploads/demi-backup-state/ directory while a restore or migration operation is actively running, so an attacker must time the request to that window, harvest the exposed key, and then forge a signed restore-state envelope to reach the unauthenticated handle_restore_step AJAX handler (CVSS vector PR:N, so no credentials are required). Risk is assessed as low-to-moderate: EPSS is only 0.32% (24th percentile), CISA SSVC records no known exploitation, and no public exploit code has been identified at time of analysis, with the active-restore prerequisite being the hard limiter.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with `__return_true`, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.
Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.
Broken access control in the Ad Invalid Click Protector (AICP) WordPress plugin up to version 1.3.0 allows unauthenticated attackers to manipulate plugin settings or disrupt its click-protection functionality. No active exploitation or public proof-of-concept is currently known, but the vulnerability is easily triggered over the network with no user interaction.
Arbitrary file deletion vulnerability in Easy Digital Downloads plugin for WordPress versions 3.6.9 and earlier allows authenticated administrators to delete arbitrary files on the server via a path traversal attack. The vulnerability leads to high availability impact (file deletion) but requires high privileges, limiting exploitability to admin users. No public exploit or active exploitation has been identified at the time of analysis.
Stored cross-site scripting (XSS) in the WooCommerce Checkout Manager plugin allows authenticated shop managers to inject arbitrary JavaScript into checkout field settings. When another administrator views the affected configuration, the malicious script executes in their browser session, potentially leading to session hijacking or unauthorized actions. No active exploitation has been reported, and the vulnerability is not listed as known exploited by CISA.
Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.
Broken access control in YayPricing ≤ 3.5.6 allows authenticated subscribers to modify pricing data or cause service disruption. The vulnerability, rated medium severity (CVSS 5.4), stems from missing authorization checks in an endpoint that should be restricted to higher-privilege roles. No public exploit code or active exploitation is known at the time of analysis.
Information disclosure in Exclusive Addons Elementor versions up to 2.8.0 allows unauthenticated remote attackers to access sensitive data. The vulnerability is classified as CWE-497 exposure of sensitive information. No public exploit code or active exploitation has been reported at time of analysis.
Server-side request forgery (SSRF) in the Feedzy WordPress plugin version 5.2.4 and below allows authenticated contributors to craft malicious RSS feed URLs, leading to unauthorized requests to internal or external resources. This could disclose limited internal service information or allow low-integrity modifications, but exploitation requires high attack complexity and contributor-level access. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Stored cross-site scripting in the Photonic Gallery & Lightbox plugin for WordPress allows authenticated attackers with Contributor-level privileges to inject arbitrary web scripts. When an administrator or other higher-privilege user views a crafted gallery or album configuration, the malicious script executes in their browser, potentially leading to session hijacking or account takeover. This affects all versions up to and including 3.33.
Stored cross-site scripting in the Location Weather WordPress plugin (≤ 3.0.6) allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When a higher-privileged user (such as an administrator) views the malicious content, the script executes in that user’s browser, potentially leading to session hijacking, site defacement, or other client-side attacks. No active exploitation or public proof-of-concept is reported, and the EPSS probability is not available.