Wordpress Plugin
Monthly
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
Broken access control in Visual Composer Website Builder plugin for WordPress allows authenticated attackers with low privileges (e.g., subscriber) to modify site content by bypassing authorization checks on restricted endpoints. No public exploit has been identified, and the SSVC decision framework indicates no current exploitation, making this a low-priority issue despite a CVSS 5.0 score.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Stored cross-site scripting (XSS) in Orbit Fox by ThemeIsle versions 3.0.7 and below allows authenticated administrators to inject malicious scripts that execute when another administrator views the affected plugin content. This vulnerability requires high privileges and user interaction; no public exploit has been identified.
Stored Cross-Site Scripting (XSS) in the BetterDocs WordPress plugin version 4.6.2 and earlier allows authenticated users with Contributor-level access to inject arbitrary web scripts. When an administrator views the crafted content, the script executes in their session, potentially leading to session hijacking or content manipulation. No active exploitation has been publicly reported.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX WordPress plugin versions up to 2.3.5 allows remote attackers to
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
Unauthenticated attackers can exploit broken access control in the Thrive Leads WordPress plugin (versions ≤10.9.2) to perform unauthorized modifications or disrupt functionality, with low integrity and availability impact. No public exploit or active exploitation has been reported at the time of analysis.
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'pagination' Shortcode Attribute. When a user accesses an injected page, the malicious scripts execute in their browser. No public exploit code has been identified, and exploitation is not confirmed in the wild.
Stored Cross-Site Scripting in SureDash WordPress plugin versions up to 1.10.0 allows authenticated attackers with contributor-level access or higher to inject malicious scripts via shortcode attributes, which execute when any user views the affected page. The vulnerability has a low EPSS score (0.20%) and no reports of active exploitation, though the attack requires only low privileges and no victim interaction beyond normal page viewing.
Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.
Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.
Order fulfillment fraud in the Payment Plugins for Stripe WooCommerce WordPress plugin allows unauthenticated network attackers to mark arbitrary pending WooCommerce orders as paid without actual payment. Any store running version 4.0.7 or earlier with the default blank webhook secret is exposed to fraudulent goods acquisition, as the plugin's webhook endpoint accepts and processes forged Stripe charge events without signature verification. No public exploit has been identified at time of analysis, but the attack requires no credentials, targets the default installation state, and is trivially automatable.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions up to and including 3.8.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via an unsanitized 'width' shortcode attribute in the Divi Builder integration. The payload executes in the browser of any user who subsequently visits an injected page, with scope change confirmed by CVSS S:C. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.
Stored Cross-Site Scripting in the Fluent Support WordPress plugin (all versions through 2.3.0) allows authenticated contributors to inject persistent JavaScript via the 'redirect-to' shortcode attribute due to missing input sanitization and output escaping in AuthHandler.php. The injected payload executes in the browser context of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or administrative action forgery. Practical exploitation is significantly constrained: the payload resides in a hidden HTML attribute and only triggers in certain browsers when the victim activates specific keyboard access keys, making mass exploitation unlikely despite the network-accessible attack path. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Stored Cross-Site Scripting in the MapSVG plugin for WordPress (versions up to and including 8.14.0) allows contributor-level authenticated attackers to permanently inject arbitrary JavaScript via unsanitized map option attributes. The injected payload persists in the database and executes in any visitor's browser upon accessing an affected page, resulting in a scope change where the attacker's code runs in the context of higher-privileged users such as administrators. No public exploit identified at time of analysis, but contributor-level access is commonly obtainable on sites allowing open registration.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.
Stored Cross-Site Scripting in Modula Image Gallery WordPress plugin versions 2.14.25 through 2.14.30 allows an authenticated low-privileged user to inject persistent malicious scripts into gallery content, which execute in the browser of any higher-privileged user who views the affected page. The Scope:Changed CVSS metric confirms cross-context script execution, enabling session hijacking, credential theft, or administrator account takeover on vulnerable WordPress sites. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.
Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.
Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
TemplateSpare WordPress plugin versions up to and including 4.2.2 exposes restricted functionality to subscriber-level authenticated users via a Broken Access Control flaw (CWE-862: Missing Authorization). Authenticated users holding the WordPress subscriber role - the lowest privilege tier - can bypass intended authorization gates and read data or invoke actions not intended for their role. No public exploit code and no CISA KEV listing are present at time of analysis, but the low attack complexity and network accessibility make this a realistic threat on sites that permit open registration or have untrusted subscriber accounts.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contributors to inject persistent malicious JavaScript into plugin-managed content. Because the CVSS vector reflects a scope change (S:C), the injected script executes in the security context of higher-privileged users - most critically WordPress administrators - who later view the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the contributor-to-admin privilege escalation path makes this a meaningful risk for multi-author WordPress installations.
Stored Cross-Site Scripting in the Liquid Speech Balloon WordPress plugin (versions <= 1.2.5) allows authenticated contributors to inject malicious scripts into speech balloon elements that execute in the browser context of higher-privileged users who view the affected content. The CVSS vector confirms PR:L and S:C, meaning a low-privileged contributor account is sufficient to plant the payload, and the scope change indicates impact extends to victim sessions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken Access Control in the Avada Custom Branding WordPress plugin (versions <= 1.2) allows authenticated users with contributor-level roles to access functionality or data restricted to higher-privileged roles, resulting in unauthorized information disclosure. The CVSS vector confirms network-exploitable, low-privilege exploitation with a limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk constrained despite the medium CVSS score.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the GT3 Themes Photo Gallery WordPress plugin (versions <= 2.7.7.29) allows authenticated users holding at minimum the Author role to inject persistent malicious JavaScript into gallery content. When a privileged user such as an administrator subsequently views the affected gallery, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the scope change (S:C) elevates practical risk by enabling privilege escalation from Author to Administrator.
Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Stored Cross-Site Scripting in the Ultimate Store Kit Elementor Addons WordPress plugin (versions <= 3.0.5) allows authenticated Contributor-level users to inject persistent malicious scripts into page content rendered for other users, including administrators. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in victims' browser sessions, enabling session hijacking, credential theft, or admin account takeover via crafted Elementor widget output. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and widespread use of Elementor-based WooCommerce stores make this a meaningful risk for multi-author WordPress deployments.
Shiptastic for WooCommerce plugin (versions ≤ 5.1.0) by Vendidero exposes an Insecure Direct Object Reference (IDOR) flaw that allows unauthenticated remote attackers to access shipment or order objects belonging to other users by manipulating predictable reference parameters. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required to trigger the issue, though impact is bounded to low confidentiality disclosure with no integrity or availability consequence. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the ListingPro WordPress plugin (versions up to and including 2.9.10) allows authenticated subscriber-level users to perform actions or access resources restricted to higher-privileged roles. The CVSS vector (PR:L/AV:N/AC:L) confirms network-reachable exploitation by any user holding a low-privilege WordPress account, with partial confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a real but moderately constrained risk.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 allows a Contributor-level authenticated attacker to inject persistent malicious JavaScript into support-related content. Because the CVSS vector carries S:C (scope change), the payload executes in the browser context of higher-privileged users - such as administrators - who subsequently view the injected content, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.
Product Slider for WooCommerce plugin (versions ≤1.13.62) exposes an Insecure Direct Object Reference flaw that allows authenticated contributors to access WooCommerce objects beyond their authorization scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-reachable exploitation requiring only a low-privilege contributor account, resulting in limited confidentiality disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, placing this in the 'monitor and patch' category rather than emergency response.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.
Cross-site request forgery in WP Google Review Slider versions up to 18.4 allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or injecting content. The vulnerability is rated medium severity (CVSS 4.3) because it requires user interaction and has only a low integrity impact. No active exploitation or public exploit code has been identified at this time.
Broken access control in Visual Composer Website Builder plugin for WordPress allows authenticated attackers with low privileges (e.g., subscriber) to modify site content by bypassing authorization checks on restricted endpoints. No public exploit has been identified, and the SSVC decision framework indicates no current exploitation, making this a low-priority issue despite a CVSS 5.0 score.
An unauthenticated broken access control vulnerability in Event Tickets through version 5.29.0.1 allows remote attackers to modify event ticket data without authentication. The vulnerability affects installations of the WordPress plugin where default configurations are in place, permitting unauthorized integrity impact. No active exploitation or public exploit code has been reported at the time of this analysis.
Sensitive data exposure in MapPress Maps for WordPress <= 2.97.6 allows unauthenticated remote attackers to access potentially sensitive information through a vulnerable plugin endpoint. The flaw, assigned CWE-497, permits disclosure of internal data such as configuration details or API keys without any user interaction, facilitating further attacks. No public exploit or active exploitation has been reported at the time of analysis, but the low attack complexity elevates its practical risk.
Stored cross-site scripting (XSS) in Orbit Fox by ThemeIsle versions 3.0.7 and below allows authenticated administrators to inject malicious scripts that execute when another administrator views the affected plugin content. This vulnerability requires high privileges and user interaction; no public exploit has been identified.
Stored Cross-Site Scripting (XSS) in the BetterDocs WordPress plugin version 4.6.2 and earlier allows authenticated users with Contributor-level access to inject arbitrary web scripts. When an administrator views the crafted content, the script executes in their session, potentially leading to session hijacking or content manipulation. No active exploitation has been publicly reported.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX WordPress plugin versions up to 2.3.5 allows remote attackers to
Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.
Arbitrary file deletion in the Kirki WordPress plugin (versions up to and including 6.0.13) allows an authenticated user with Editor-level privileges to delete files on the server via a path traversal flaw (CWE-22). The vulnerability is not exploitable by unauthenticated attackers, requires no victim interaction, and has no public exploit identified at time of analysis (CISA KEV: not listed, EPSS 0.33%). The impact is limited to availability, as successful exploitation can remove files but does not expose data or enable code execution, making this a moderate-priority issue.
Unauthenticated attackers can exploit broken access control in the Thrive Leads WordPress plugin (versions ≤10.9.2) to perform unauthorized modifications or disrupt functionality, with low integrity and availability impact. No public exploit or active exploitation has been reported at the time of analysis.
Sensitive data exposure in the Yukassa for WooCommerce plugin allows authenticated subscribers to access sensitive payment information, potentially including transaction details or customer data. The vulnerability affects plugin versions up to 2.16.1. No public exploit or active exploitation has been identified at the time of analysis.
Broken access control in RT Mega Menu plugin for WordPress ≤1.5.1 allows authenticated subscribers to modify mega menu settings without proper authorization checks. This could lead to unauthorized changes to navigation structures, potentially facilitating phishing or content tampering. No public exploit or active exploitation reported at time of analysis.
Authenticated users holding only a Subscriber-level WordPress account can disrupt the fundraising functionality of sites running the FundEngine plugin (slug wp-fundraising-donation) through version 1.7.8, because a plugin action omits its capability and nonce authorization checks (CWE-862 missing authorization). The effect is limited to availability - there is no data disclosure or modification - and access requires an existing low-privilege login, which is realistic mainly where open user registration is enabled or the attacker already has an account. No public exploit code has been identified and there is no indication of active exploitation; EPSS is a low 0.35% (28th percentile) and CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial.
Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote attackers to modify event data and partially disrupt service availability without user interaction. This broken access control flaw stems from a missing capability check (CWE-862) on a REST API or AJAX endpoint, leading to low integrity and availability impact with no confidentiality loss.
Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'pagination' Shortcode Attribute. When a user accesses an injected page, the malicious scripts execute in their browser. No public exploit code has been identified, and exploitation is not confirmed in the wild.
Stored Cross-Site Scripting in SureDash WordPress plugin versions up to 1.10.0 allows authenticated attackers with contributor-level access or higher to inject malicious scripts via shortcode attributes, which execute when any user views the affected page. The vulnerability has a low EPSS score (0.20%) and no reports of active exploitation, though the attack requires only low privileges and no victim interaction beyond normal page viewing.
Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.
Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.
Order fulfillment fraud in the Payment Plugins for Stripe WooCommerce WordPress plugin allows unauthenticated network attackers to mark arbitrary pending WooCommerce orders as paid without actual payment. Any store running version 4.0.7 or earlier with the default blank webhook secret is exposed to fraudulent goods acquisition, as the plugin's webhook endpoint accepts and processes forged Stripe charge events without signature verification. No public exploit has been identified at time of analysis, but the attack requires no credentials, targets the default installation state, and is trivially automatable.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions up to and including 3.8.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via an unsanitized 'width' shortcode attribute in the Divi Builder integration. The payload executes in the browser of any user who subsequently visits an injected page, with scope change confirmed by CVSS S:C. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.
Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.
Stored Cross-Site Scripting in the Fluent Support WordPress plugin (all versions through 2.3.0) allows authenticated contributors to inject persistent JavaScript via the 'redirect-to' shortcode attribute due to missing input sanitization and output escaping in AuthHandler.php. The injected payload executes in the browser context of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or administrative action forgery. Practical exploitation is significantly constrained: the payload resides in a hidden HTML attribute and only triggers in certain browsers when the victim activates specific keyboard access keys, making mass exploitation unlikely despite the network-accessible attack path. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Stored Cross-Site Scripting in the MapSVG plugin for WordPress (versions up to and including 8.14.0) allows contributor-level authenticated attackers to permanently inject arbitrary JavaScript via unsanitized map option attributes. The injected payload persists in the database and executes in any visitor's browser upon accessing an affected page, resulting in a scope change where the attacker's code runs in the context of higher-privileged users such as administrators. No public exploit identified at time of analysis, but contributor-level access is commonly obtainable on sites allowing open registration.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.
Stored Cross-Site Scripting in Modula Image Gallery WordPress plugin versions 2.14.25 through 2.14.30 allows an authenticated low-privileged user to inject persistent malicious scripts into gallery content, which execute in the browser of any higher-privileged user who views the affected page. The Scope:Changed CVSS metric confirms cross-context script execution, enabling session hijacking, credential theft, or administrator account takeover on vulnerable WordPress sites. No public exploit code and no CISA KEV listing exist at time of analysis.
Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.
Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.
Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
TemplateSpare WordPress plugin versions up to and including 4.2.2 exposes restricted functionality to subscriber-level authenticated users via a Broken Access Control flaw (CWE-862: Missing Authorization). Authenticated users holding the WordPress subscriber role - the lowest privilege tier - can bypass intended authorization gates and read data or invoke actions not intended for their role. No public exploit code and no CISA KEV listing are present at time of analysis, but the low attack complexity and network accessibility make this a realistic threat on sites that permit open registration or have untrusted subscriber accounts.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contributors to inject persistent malicious JavaScript into plugin-managed content. Because the CVSS vector reflects a scope change (S:C), the injected script executes in the security context of higher-privileged users - most critically WordPress administrators - who later view the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the contributor-to-admin privilege escalation path makes this a meaningful risk for multi-author WordPress installations.
Stored Cross-Site Scripting in the Liquid Speech Balloon WordPress plugin (versions <= 1.2.5) allows authenticated contributors to inject malicious scripts into speech balloon elements that execute in the browser context of higher-privileged users who view the affected content. The CVSS vector confirms PR:L and S:C, meaning a low-privileged contributor account is sufficient to plant the payload, and the scope change indicates impact extends to victim sessions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken Access Control in the Avada Custom Branding WordPress plugin (versions <= 1.2) allows authenticated users with contributor-level roles to access functionality or data restricted to higher-privileged roles, resulting in unauthorized information disclosure. The CVSS vector confirms network-exploitable, low-privilege exploitation with a limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk constrained despite the medium CVSS score.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the GT3 Themes Photo Gallery WordPress plugin (versions <= 2.7.7.29) allows authenticated users holding at minimum the Author role to inject persistent malicious JavaScript into gallery content. When a privileged user such as an administrator subsequently views the affected gallery, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the scope change (S:C) elevates practical risk by enabling privilege escalation from Author to Administrator.
Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in WP Activity Log (WordPress plugin by Melapress, versions ≤ 5.6.4) enables unauthenticated remote attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated administrator into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) confirms network-reachable exploitation with no attacker privileges required, resulting in limited integrity and availability impact - notably, an attacker could forge requests to disable or clear activity logs, undermining the plugin's core security audit function. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Stored Cross-Site Scripting in the Ultimate Store Kit Elementor Addons WordPress plugin (versions <= 3.0.5) allows authenticated Contributor-level users to inject persistent malicious scripts into page content rendered for other users, including administrators. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in victims' browser sessions, enabling session hijacking, credential theft, or admin account takeover via crafted Elementor widget output. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and widespread use of Elementor-based WooCommerce stores make this a meaningful risk for multi-author WordPress deployments.
Shiptastic for WooCommerce plugin (versions ≤ 5.1.0) by Vendidero exposes an Insecure Direct Object Reference (IDOR) flaw that allows unauthenticated remote attackers to access shipment or order objects belonging to other users by manipulating predictable reference parameters. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required to trigger the issue, though impact is bounded to low confidentiality disclosure with no integrity or availability consequence. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.
Broken access control in Query Wrangler WordPress plugin version 1.5.57 and earlier allows authenticated subscriber-level users to access restricted functionality beyond their intended permissions. The CWE-862 (Missing Authorization) root cause indicates the plugin fails to verify whether the requesting user holds sufficient privileges before executing sensitive operations. No active exploitation is confirmed in CISA KEV, and CVSS rates this a medium-severity (4.3) network-exploitable issue with limited confidentiality impact and no integrity or availability consequence.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.
Broken Access Control in the Style Kits WordPress plugin (versions <= 2.6.5) permits authenticated users holding Contributor-level roles to execute privileged actions without proper authorization checks, as classified under CWE-862 (Missing Authorization). Reported by Patchstack and tracked as EUVD-2026-48095, the flaw is remotely exploitable with low attack complexity and no user interaction, exposing partial confidentiality, integrity, and availability of affected WordPress installations. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Broken access control in the Reviewer WordPress plugin (versions ≤ 3.14.2) allows subscriber-level authenticated users to perform actions beyond their intended authorization scope, resulting in limited integrity and availability impact on affected installations. Reported by Patchstack and tracked under EUVD-2026-48090, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the ListingPro WordPress plugin (versions up to and including 2.9.10) allows authenticated subscriber-level users to perform actions or access resources restricted to higher-privileged roles. The CVSS vector (PR:L/AV:N/AC:L) confirms network-reachable exploitation by any user holding a low-privilege WordPress account, with partial confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a real but moderately constrained risk.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 allows a Contributor-level authenticated attacker to inject persistent malicious JavaScript into support-related content. Because the CVSS vector carries S:C (scope change), the payload executes in the browser context of higher-privileged users - such as administrators - who subsequently view the injected content, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Cross-Site Request Forgery in the Zarinpal Gateway WordPress/WooCommerce plugin (versions ≤5.1.0) enables unauthenticated remote attackers to forge HTTP requests on behalf of authenticated site users or administrators, resulting in unauthorized state changes within the plugin. The CVSS vector (PR:N/UI:R/S:U/I:L) confirms exploitation requires no attacker authentication but depends on luring an authenticated victim to a malicious page. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it in a moderate-priority remediation tier.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.
Product Slider for WooCommerce plugin (versions ≤1.13.62) exposes an Insecure Direct Object Reference flaw that allows authenticated contributors to access WooCommerce objects beyond their authorization scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-reachable exploitation requiring only a low-privilege contributor account, resulting in limited confidentiality disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, placing this in the 'monitor and patch' category rather than emergency response.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss.
Broken access control in ShopLentor Pro (WordPress WooCommerce page builder plugin) versions up to and including 2.8.5 allows authenticated subscriber-level users to perform privileged actions beyond their intended authorization scope, resulting in unauthorized data or configuration modification. The flaw is network-accessible with low attack complexity and requires only a low-privilege WordPress account. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog.