Wordpress Plugin
Monthly
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.
Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.
Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.
Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.
Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Server-Side Request Forgery in the Photo Block WordPress plugin (versions 1.7.1 and earlier) allows authenticated administrators to cause the hosting WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network services. The CVSS scope-change flag (S:C) indicates impact extends beyond WordPress itself to back-end infrastructure reachable from the server. No public exploit code and no CISA KEV listing exist at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool to compromised admin accounts or rogue administrators.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in the Grid/List View for WooCommerce WordPress plugin (versions ≤ 3.0.9) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'position' shortcode attribute, executing against every visitor who loads an affected page. The plugin's all_page="1" shortcode attribute compounds severity by forcing the widget to render site-wide, meaning a single injected post can target all visitors rather than only those on shop or category pages. No public exploit or CISA KEV listing identified at time of analysis; a patch has been committed to the WordPress plugin repository.
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
SQL Injection in the Premium Packages - Sell Digital Products Securely WordPress plugin (all versions through 7.0.4) allows authenticated administrators to append arbitrary SQL to existing queries by manipulating the unsanitized 'orderby' parameter in the order renewal management view. Successful exploitation enables full read access to the WordPress database, exposing potentially sensitive records such as customer data, license keys, and payment history. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, Wordfence has published source-level references pinpointing the exact vulnerable lines, and a fix commit (changeset 3611573) appears in the plugin's SVN repository.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) allows authenticated attackers holding the plugin's Staff role to append arbitrary SQL to existing queries via the unescaped 'tc_event_filter' parameter, extracting sensitive data from the WordPress database. The exposure is enabled by the plugin's own add_required_capabilities() function, which grants the custom Staff role the edit_tc_tickets_instances capability - meaning any staff-level account can reach the vulnerable tc_tickets_instances admin list screen and trigger the injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (staff role, not admin) and high confidentiality impact make this a meaningful risk for multi-tenant event-ticketing deployments.
GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary shortcode injection in the Contact Form 7 - Dynamic Text Extension WordPress plugin (all versions ≤ 5.0.6) allows unauthenticated remote attackers to execute any registered WordPress shortcode on the target site by submitting crafted form input that bypasses input validation before reaching the native do_shortcode() function. The blast radius depends on what shortcodes are registered by other installed plugins, making high-privilege shortcodes the real threat multiplier. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a partial patch shipped in 5.0.4 was insufficient, leaving sites on all sub-5.0.7 versions exposed.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.
OAuth refresh token theft in HubSpot All-In-One Marketing - Forms, Popups, Live Chat (WordPress plugin 'leadin') exposes connected HubSpot tenants to unauthorized access. Authenticated WordPress users at contributor level or above can extract a plaintext HubSpot OAuth refresh token directly from the client-side window.leadinConfig JavaScript object, which is populated server-side via wp_localize_script() after the plugin decrypts the at-rest AES-256-CTR-encrypted token - rendering the encryption entirely ineffective against this attack path. A stolen token can be replayed against the HubSpot OAuth API to access or modify CRM contacts, marketing campaigns, and other tenant data in the connected HubSpot account. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauthenticated network attackers to inject arbitrary JavaScript into hotel booking archive pages via the unsanitized `check_in_date` parameter. When a victim clicks a crafted URL, the payload executes in their browser under the WordPress site's origin — enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim, including against administrator accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the CVSS scope-change metric (S:C) elevates the base score to 6.1 by reflecting cross-context browser impact.
Stored Cross-Site Scripting in the Ninja Forms Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into the admin Excel Export screen. The dual root cause is a missing capability check and nonce verification in the save_filter() AJAX handler - enabling any authenticated user to write arbitrary filter data to WordPress options - combined with unescaped concatenation of that data into HTML attributes in get_filter_row(). When administrative users subsequently visit the Excel Export admin page, the stored payload executes in their browser, enabling session hijack, credential theft, or further privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the ChatHelp plugin for WordPress (versions through 3.5.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'number' and 'group' shortcode attributes, which execute in victims' browsers on page load. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode rendering layer, identified across multiple source files in CustomButtonsTemplates.php and CustomShortcode.php. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, Wordfence has published a threat intelligence entry and a patch changeset exists in the WordPress plugin repository.
Authorization bypass in the WP ERP WordPress plugin (versions through 1.17.6) allows authenticated attackers with subscriber-level access to create arbitrary company locations in the ERP database. The flaw stems from a missing authorization check in the plugin's Admin AJAX handler, as identified by Wordfence and corroborated by source code references at includes/Admin/Ajax.php. No public exploit code or CISA KEV listing exists at time of analysis, but the low privilege bar (any registered WordPress user) on a network-accessible endpoint makes opportunistic abuse straightforward on sites with open user registration.
Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected `wp2pcl_ajax_process_request_inner` AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible `tmp/` directory at a predictable URL, exposing `wp-config.php` database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Subscriber-level WordPress users can exfiltrate complete PII datasets from all Ninja Forms submissions site-wide in Ninja Forms - Excel Export versions up to and including 3.3.6 by supplying arbitrary values to the `spreadsheet_export_form_id` parameter, which lacks authorization validation at the export endpoint. The missing access control enables horizontal privilege escalation across all form IDs on the installation, delivering names, email addresses, phone numbers, physical addresses, and any other collected PII as downloadable XLSX files to low-privileged users who should have no cross-form access. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the low attack complexity (AC:L, no user interaction required beyond subscriber-level credentials) makes this a meaningful data privacy risk on WordPress sites with open user registration.
Directory traversal in the Ninja Forms - Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to write .xls/.xlsx files to arbitrary server-side locations via the unsanitized 'spreadsheet_export_tmp_name' parameter. The vulnerability is a staging primitive: direct code execution is not possible through the traversal alone, but file placement in web-accessible or sensitive directories can enable follow-on attacks such as information disclosure or overwriting existing files. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated settings reset in the Fense Proxy & VPN Blocker WordPress plugin (versions up to and including 3.0.1) allows any remote attacker to wipe the plugin's API key cache and configuration by invoking an unprotected AJAX endpoint. The fense_bpvt_save_settings() function is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks without any capability check or nonce validation, meaning it is reachable without authentication and calls delete_option() and delete_transient() unconditionally on plugin-critical data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivial to execute and carries a meaningful functional consequence: disabling the site's VPN and proxy detection capability.
Stored cross-site scripting in the Smart Custom Fields WordPress plugin (versions up to and including 5.0.7) enables authenticated attackers holding at minimum Author-level access to persist malicious JavaScript payloads by supplying unsanitized content in uploaded image attachment titles. Any site visitor who subsequently loads an affected page triggers execution of the injected script within their browser, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of that user. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; however, the vulnerability is partially unresolved even in the stated boundary version 5.0.7, making the precise remediation target unclear without consulting the referenced patch changesets.
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding the wpamelia-manager role to exfiltrate arbitrary data from the site's database via the Customer Import feature. The flaw stems from unsanitized user-supplied parameters passed into pre-existing SQL queries without adequate escaping or prepared statement usage, enabling stacked or appended query manipulation. No public exploit code or active exploitation has been identified at the time of analysis, and the confidentiality-only impact (C:H/I:N/A:N) reflects read-level database access rather than modification or destruction capability.
Stored Cross-Site Scripting in the SysBasics Customize My Account for WooCommerce plugin (all versions through 4.4.14) allows authenticated shop managers to persist malicious scripts via the unsanitized 'row_type' parameter, executing in any user's browser upon visiting the compromised My Account page. The CVSS scope change (S:C) confirms cross-user impact - injected scripts run in victim sessions, enabling session hijacking or credential theft beyond the attacker's own context. No public exploit code or CISA KEV listing is confirmed at time of analysis; risk is substantially gated by the shop manager privilege requirement.
SQL injection in the WP Bulk Delete WordPress plugin (all versions up to and including 1.4.2) allows authenticated attackers holding administrator-level privileges to append arbitrary SQL to existing queries via the delete_user_roles POST parameter, enabling full database read access. The root cause is a code-level stripping of WordPress's built-in magic-quotes protection: wp_unslash() is called on the raw POST body before parse_str() decomposes it, leaving attacker-controlled values fully unescaped when they reach the SQL sink in class-delete-api.php. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; real-world risk is bounded by the administrator authentication requirement.
Stored Cross-Site Scripting in the wpForo Forum WordPress plugin (all versions through 3.1.1) allows authenticated attackers with subscriber-level access to permanently inject malicious JavaScript via the 'location' profile field. The root failure is WordPress's native sanitize_text_field() function, which strips tags but leaves double quotes unencoded, enabling attribute breakout from an href context into injected event-handler attributes. With a CVSS scope change (S:C), successful exploitation can impact sessions of any user - including administrators - who views a poisoned profile page, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) allows authenticated contributors to inject persistent malicious scripts via the price_wrapper shortcode attribute, due to missing sanitization and output escaping in class.shortcodes.php. A compromised or malicious contributor account can plant the payload in any page or post, where it executes against visiting victims - but only those who carry the referenced ticket ID in their cart cookie, materially narrowing the realistic victim pool. No active exploitation has been confirmed in CISA KEV, and no EPSS data was provided in the intelligence feed.
Authorization bypass in the WPBot AI ChatBot plugin for WordPress (all versions ≤ 8.5.6) permits any subscriber-level authenticated user to invoke the plugin's RAG document re-embedding functionality without authorization, directly modifying the rag_documents database table and triggering calls to the site owner's paid AI APIs (OpenAI, Gemini, OpenRouter, or xAI). The root cause is a missing capability check in class-qcld-bot-rag.php, confirmed by Wordfence and traceable to specific code paths in qcld-wpwbot.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.3 Medium score reflects constrained direct security impact - though financial harm from API credit exhaustion represents the primary real-world risk.
Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
SQL Injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.6) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL to existing queries via the unsanitized 'filtersource' parameter, exposing sensitive data stored in the WordPress database. The flaw originates from insufficient escaping and missing prepared statement usage across multiple display and admin class files identified by Wordfence. No public exploit code or active exploitation has been identified at time of analysis, and the high privilege requirement significantly constrains real-world impact.
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with custom-role access or above to append arbitrary SQL to database queries and extract sensitive information. The attack is split across two phases: a malicious payload is stored during quiz abandonment via the wp_ajax_tutor_quiz_abandon AJAX handler, and the injected SQL fires only when a privileged user or Tutor REST API key holder fetches /wp-json/tutor/v1/quiz-attempt-details/{id}. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
SQL Injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) permits authenticated attackers holding a custom-level role or above to append arbitrary SQL to existing queries via the unsanitized 's' search parameter, enabling full database read access. The vulnerability originates in the better-attendees-and-tickets addon (index.php lines 50, 485, and 502) and is confirmed by Wordfence with source code evidence. No active exploitation is confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, keeping real-world urgency moderate despite the High confidentiality impact.
Second-order SQL injection in Quiz Master Next (QSM) for WordPress through version 11.2.0 allows authenticated attackers holding Author-level access to plant SQL payloads in quiz page data that execute whenever any user - including administrators - views the affected quiz's Questions tab. The root cause is a two-stage failure: the qsm_ajax_save_pages() AJAX handler sanitizes user-supplied 'pages' values only with sanitize_text_field() (which strips HTML/PHP tags but does not escape SQL-special characters), then qsm_options_questions_tab_content() at line 143 reconstructs those stored values into an IN() clause via implode() with no $wpdb->prepare() call and no integer casting. No public exploit code has been identified at time of analysis; however, the split-phase attack pattern - where payload planting and execution are decoupled - commonly evades first-order WAF detection and standard code scanning, elevating practical risk beyond the 6.5 CVSS score alone.
Authorization bypass in The Cache Purger WordPress plugin (all versions through 2.3.20) allows any subscriber-level authenticated user to permanently destroy the plugin's entire cache-purge audit log (wp-content/purge.log). The root cause is that the tcp_log_purge nonce - the only credential required to trigger log deletion - is rendered in the WordPress admin bar on frontend pages visible to all authenticated users, including the lowest-privilege subscribers, making the authorization check trivially bypassable. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the WP Delicious (formerly Delicious Recipes) WordPress plugin versions up to and including 1.10.2 allows authenticated Contributor-level users to inject arbitrary JavaScript via unsanitized `javascript:` URIs embedded in recipe step link attributes. The `wrap_direction_text()` function interpolates attacker-controlled `href` values directly into anchor tags using `sprintf()` without invoking WordPress's `esc_url()`, enabling payload execution in the browser of any privileged user who clicks the poisoned link while previewing or viewing the affected recipe post. No CISA KEV listing or public exploit code has been identified at time of analysis, though Wordfence's source-level disclosure provides sufficient detail for independent reproduction.
SQL Injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'sort_field' parameter, exposing sensitive database contents. The vulnerability resides in seo-booster.php (lines 389, 404, 406) where user-supplied sort input is neither escaped nor parameterized before being incorporated into SQL execution. Despite a high confidentiality impact, exploitation is gated behind WordPress administrator-level credentials (PR:H), substantially limiting the realistic attack surface. No public exploit identified at time of analysis; a WordPress Trac changeset (3606177) suggests a patch has been committed.
Time-based SQL injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) allows authenticated administrators to extract sensitive database contents by manipulating the unquoted 'orderby' parameter in the Google Search Console list table component. The root cause is that developer-applied sanitization functions esc_sql() and sanitize_text_field() fail to neutralize SQL keywords, subquery syntax, commas, or parentheses when used in an ORDER BY clause context, leaving the clause fully attacker-controlled. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS score data was not provided.
Reflected Cross-Site Scripting in the Product Feed Manager For WooCommerce WordPress plugin (all versions through 7.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unescaped 's' search parameter, which executes in a victim's browser upon interaction with a crafted link. The vulnerability is rooted in insufficient sanitization and output escaping within the plugin's admin-facing PHP classes, as confirmed by Wordfence with direct source code references to class-rex-product-feed-actions.php and class-rex-product-feed.php. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the Easy Accordion - AI-Powered FAQ & Accordion Blocks, Product FAQ plugin (all versions ≤ 3.1.6) enables authenticated attackers holding contributor-level WordPress roles to inject persistent JavaScript payloads via the unsanitized 'align' block attribute. The injected script executes in the browser of any user - including administrators - who views the affected page, making session hijacking and privilege escalation realistic follow-on impacts. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence source code references pinpoint the exact vulnerable lines, substantially lowering the barrier to exploitation.
SQL injection in MultiVendorX (WooCommerce Multivendor Marketplace) plugin versions up to and including 5.0.9 allows any authenticated WordPress user to extract sensitive data from the database via the unparameterized 'order_by' argument in the transactions REST endpoint. Critically, the default plugin configuration automatically approves store owner registrations, meaning any subscriber-level WordPress account holder can self-elevate to store_owner role via the public Stores REST endpoint, then immediately exploit the injection - effectively lowering the real-world privilege bar to any authenticated user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the default-on privilege escalation path substantially raises exploitability beyond the PR:L CVSS score suggests.
Stored XSS in GiveWP's Sequoia donation template allows authenticated attackers with give worker-level access to inject persistent JavaScript payloads via the 'twitter_message' template setting, affecting all WordPress installations running plugin versions through 4.16.3. The injected payload is not sanitized before being embedded inside a JavaScript template literal in the Sequoia confirmation view's social-sharing component, and executes in the donor's browser specifically when they click the 'Share on Twitter' button after completing a donation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the Wordfence disclosure includes direct source code references confirming the unsanitized evaluation path.
Cross-site request forgery in the Landing Page Builder - Coming Soon Page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin (all versions up to and including 1.5.3.6) allows unauthenticated remote attackers to manipulate arbitrary WordPress posts by sending a forged AJAX request that inherits an authenticated editor or administrator's browser session. Missing nonce validation on the ulpb_admin_ajax function means a victim who clicks a crafted link while logged in unknowingly authorizes post creation, modification of titles, slugs, types, status, and injection of ULPB_DATA post meta. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified; EPSS data was not provided in available intelligence.
Sensitive information exposure in the List Category Posts WordPress plugin (all versions through 0.95.0) allows authenticated contributors to read non-public posts belonging to other users - including pending-review, scheduled, and trashed content with full body text, excerpts, authors, and custom-field metadata. Exploitation requires only a contributor-level account and the ability to embed the native [catlist] shortcode in a draft post, then preview it, triggering the flawed sanitize_status logic. This is a confirmed bypass of the incomplete authorization fix shipped in version 0.93.0 for CVE-2025-11377, indicating the root authorization flaw was never fully remediated. No public exploit code or CISA KEV listing is identified at time of analysis.
Missing authorization in the Catch Themes Demo Import WordPress plugin (versions up to and including 3.3) allows any subscriber-level authenticated user to force-install a hardcoded third-party plugin onto the target WordPress site. The vulnerability exists because catch_themes_demo_import_activate_plugin(), hooked on admin_init, invokes Plugin_Upgrader::install() to fetch and install 'essential-content-types' from WordPress.org before performing the current_user_can('activate_plugins') capability check - a classic authorization-check inversion. No public exploit code has been identified at time of analysis, and the constrained impact (only one hardcoded plugin can be installed, not arbitrary ones) meaningfully limits real-world severity despite the low authentication requirement.
Stored Cross-Site Scripting in the MxChat AI Chatbot & Content Generation WordPress plugin (versions up to and including 3.2.10) enables authenticated administrators to persist malicious scripts through admin settings panels. Exploitation is constrained to WordPress multi-site environments or single-site installs where the unfiltered_html capability has been explicitly disabled, narrowing the realistic attack surface significantly. No public exploit code or active exploitation (CISA KEV) has been identified; CVSS 4.4 Medium reflects the restricted conditions and high privilege requirement.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Stored Cross-Site Scripting in WP Customer Area WordPress plugin (versions up to and including 8.3.5) allows authenticated attackers with Contributor-level access or above to persistently inject arbitrary JavaScript via the unsanitized 'type' attribute of the customer-area-protected-content shortcode. The injected payload executes in the browser of any user who visits the compromised page, enabling session hijacking, credential theft, or malicious redirects against site visitors. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; however, the Contributor-level prerequisite is a low barrier in multi-author WordPress environments.
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
Unauthorized account self-registration in the FoodBook Lite WordPress plugin through version 1.5.6 allows unauthenticated remote attackers to create 'customer'-role accounts and obtain valid WordPress authentication cookies, even when the site administrator has explicitly disabled user registration. The flaw exists because the plugin's registration() function is registered on the publicly accessible wp_ajax_nopriv_registration_action AJAX hook and calls wp_insert_user() without performing nonce verification, capability checks, or consulting the users_can_register site option. No public exploit has been identified at time of analysis and no KEV listing exists; Wordfence reported the issue with a confirmed fix in version 1.5.7.
Sensitive information exposure in the Smart Slider 3 WordPress plugin (all versions up to and including 3.5.1.37) allows authenticated Contributor-level users to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts belonging to any user on the site - including Administrators and Editors - via the unsecured 'keyword' Ajax parameter. The attack barrier is further lowered because the required nonce is automatically emitted on /wp-admin/post-new.php, a page accessible to any Contributor by default through the edit_posts capability, making nonce acquisition trivial. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Missing authorization controls in the Car Rental Manager WordPress plugin (≤1.3.7) allow unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited integrity impact. The CVSS vector (PR:N/UI:N) confirms exploitation requires no credentials or user interaction against any publicly reachable WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world risk at a moderate level despite the trivial exploitation conditions.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in the Church Admin WordPress plugin (versions through 5.0.30) allows unauthenticated remote attackers to invoke plugin endpoints and perform unauthorized write operations without authentication. The root cause is incorrectly configured access control security levels (CWE-862), where certain plugin actions omit the required capability or nonce checks. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier CVSS vector (PR:N, AC:L, AV:N) means opportunistic abuse is technically straightforward for any attacker who can reach the WordPress instance.
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
WP EasyPay WordPress plugin versions 4.5.0 and earlier permit any subscriber-level authenticated user to delete arbitrary site content due to a missing authorization check (CWE-862). The plugin fails to enforce capability verification before processing deletion requests, meaning any user holding the lowest standard WordPress role can permanently destroy posts, pages, or other content objects outside their normal permissions. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this straightforward to abuse on any site where user registration is open.
Unauthenticated broken access control in the Knit Pay WordPress payment plugin (versions <= 9.6.0.0) allows remote, unauthenticated attackers to perform unauthorized actions resulting in limited integrity and availability impact against affected WordPress installations. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms no authentication or user interaction is required, lowering the exploitation barrier significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants prompt remediation on any publicly accessible WordPress deployment running this plugin.
Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.
Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.
Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.
Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.
Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.
Broken Access Control in the Participants Database WordPress plugin (versions <= 2.7.8.4) permits authenticated subscriber-level users to perform privileged write operations that should be restricted to higher roles such as editors or administrators. The CVSS vector (PR:L/I:L/C:N/A:N) confirms low-privileged network exploitation resulting in unauthorized integrity impact with no confidentiality or availability consequences. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.
Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Server-Side Request Forgery in the Photo Block WordPress plugin (versions 1.7.1 and earlier) allows authenticated administrators to cause the hosting WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network services. The CVSS scope-change flag (S:C) indicates impact extends beyond WordPress itself to back-end infrastructure reachable from the server. No public exploit code and no CISA KEV listing exist at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool to compromised admin accounts or rogue administrators.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Cross-Site Request Forgery in WP Accessibility Helper (WAH) plugin versions 0.6.6 and below enables remote unauthenticated attackers to perform unauthorized state-changing actions against the plugin by tricking an authenticated WordPress administrator into visiting a crafted malicious page. The vulnerability arises from missing or unvalidated nonce checks on sensitive plugin endpoints, allowing forged cross-origin requests to execute in the victim's authenticated session context. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in the Grid/List View for WooCommerce WordPress plugin (versions ≤ 3.0.9) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'position' shortcode attribute, executing against every visitor who loads an affected page. The plugin's all_page="1" shortcode attribute compounds severity by forcing the widget to render site-wide, meaning a single injected post can target all visitors rather than only those on shop or category pages. No public exploit or CISA KEV listing identified at time of analysis; a patch has been committed to the WordPress plugin repository.
Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.
SQL Injection in the Premium Packages - Sell Digital Products Securely WordPress plugin (all versions through 7.0.4) allows authenticated administrators to append arbitrary SQL to existing queries by manipulating the unsanitized 'orderby' parameter in the order renewal management view. Successful exploitation enables full read access to the WordPress database, exposing potentially sensitive records such as customer data, license keys, and payment history. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; however, Wordfence has published source-level references pinpointing the exact vulnerable lines, and a fix commit (changeset 3611573) appears in the plugin's SVN repository.
Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.
SQL injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.1) allows authenticated attackers holding the plugin's Staff role to append arbitrary SQL to existing queries via the unescaped 'tc_event_filter' parameter, extracting sensitive data from the WordPress database. The exposure is enabled by the plugin's own add_required_capabilities() function, which grants the custom Staff role the edit_tc_tickets_instances capability - meaning any staff-level account can reach the vulnerable tc_tickets_instances admin list screen and trigger the injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication bar (staff role, not admin) and high confidentiality impact make this a meaningful risk for multi-tenant event-ticketing deployments.
GutenKit Blocks for WordPress exposes a site's stored Mailchimp API key and full audience configuration to any unauthenticated HTTP caller via two REST API endpoints registered without authorization checks in versions up to and including 2.4.12. Both /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests use permission_callback => '__return_true', stripping all access control and returning Mailchimp audience IDs, merge fields, interest categories, and subscriber counts alongside the raw API key. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but exploitation requires only a single unauthenticated HTTP GET request, making mass automated scanning trivially feasible on any site with the Mailchimp integration configured.
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.
Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary shortcode injection in the Contact Form 7 - Dynamic Text Extension WordPress plugin (all versions ≤ 5.0.6) allows unauthenticated remote attackers to execute any registered WordPress shortcode on the target site by submitting crafted form input that bypasses input validation before reaching the native do_shortcode() function. The blast radius depends on what shortcodes are registered by other installed plugins, making high-privilege shortcodes the real threat multiplier. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, a partial patch shipped in 5.0.4 was insufficient, leaving sites on all sub-5.0.7 versions exposed.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.
OAuth refresh token theft in HubSpot All-In-One Marketing - Forms, Popups, Live Chat (WordPress plugin 'leadin') exposes connected HubSpot tenants to unauthorized access. Authenticated WordPress users at contributor level or above can extract a plaintext HubSpot OAuth refresh token directly from the client-side window.leadinConfig JavaScript object, which is populated server-side via wp_localize_script() after the plugin decrypts the at-rest AES-256-CTR-encrypted token - rendering the encryption entirely ineffective against this attack path. A stolen token can be replayed against the HubSpot OAuth API to access or modify CRM contacts, marketing campaigns, and other tenant data in the connected HubSpot account. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauthenticated network attackers to inject arbitrary JavaScript into hotel booking archive pages via the unsanitized `check_in_date` parameter. When a victim clicks a crafted URL, the payload executes in their browser under the WordPress site's origin — enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim, including against administrator accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the CVSS scope-change metric (S:C) elevates the base score to 6.1 by reflecting cross-context browser impact.
Stored Cross-Site Scripting in the Ninja Forms Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into the admin Excel Export screen. The dual root cause is a missing capability check and nonce verification in the save_filter() AJAX handler - enabling any authenticated user to write arbitrary filter data to WordPress options - combined with unescaped concatenation of that data into HTML attributes in get_filter_row(). When administrative users subsequently visit the Excel Export admin page, the stored payload executes in their browser, enabling session hijack, credential theft, or further privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the ChatHelp plugin for WordPress (versions through 3.5.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'number' and 'group' shortcode attributes, which execute in victims' browsers on page load. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode rendering layer, identified across multiple source files in CustomButtonsTemplates.php and CustomShortcode.php. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, Wordfence has published a threat intelligence entry and a patch changeset exists in the WordPress plugin repository.
Authorization bypass in the WP ERP WordPress plugin (versions through 1.17.6) allows authenticated attackers with subscriber-level access to create arbitrary company locations in the ERP database. The flaw stems from a missing authorization check in the plugin's Admin AJAX handler, as identified by Wordfence and corroborated by source code references at includes/Admin/Ajax.php. No public exploit code or CISA KEV listing exists at time of analysis, but the low privilege bar (any registered WordPress user) on a network-accessible endpoint makes opportunistic abuse straightforward on sites with open user registration.
Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected `wp2pcl_ajax_process_request_inner` AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible `tmp/` directory at a predictable URL, exposing `wp-config.php` database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Subscriber-level WordPress users can exfiltrate complete PII datasets from all Ninja Forms submissions site-wide in Ninja Forms - Excel Export versions up to and including 3.3.6 by supplying arbitrary values to the `spreadsheet_export_form_id` parameter, which lacks authorization validation at the export endpoint. The missing access control enables horizontal privilege escalation across all form IDs on the installation, delivering names, email addresses, phone numbers, physical addresses, and any other collected PII as downloadable XLSX files to low-privileged users who should have no cross-form access. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the low attack complexity (AC:L, no user interaction required beyond subscriber-level credentials) makes this a meaningful data privacy risk on WordPress sites with open user registration.
Directory traversal in the Ninja Forms - Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to write .xls/.xlsx files to arbitrary server-side locations via the unsanitized 'spreadsheet_export_tmp_name' parameter. The vulnerability is a staging primitive: direct code execution is not possible through the traversal alone, but file placement in web-accessible or sensitive directories can enable follow-on attacks such as information disclosure or overwriting existing files. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated settings reset in the Fense Proxy & VPN Blocker WordPress plugin (versions up to and including 3.0.1) allows any remote attacker to wipe the plugin's API key cache and configuration by invoking an unprotected AJAX endpoint. The fense_bpvt_save_settings() function is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks without any capability check or nonce validation, meaning it is reachable without authentication and calls delete_option() and delete_transient() unconditionally on plugin-critical data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivial to execute and carries a meaningful functional consequence: disabling the site's VPN and proxy detection capability.
Stored cross-site scripting in the Smart Custom Fields WordPress plugin (versions up to and including 5.0.7) enables authenticated attackers holding at minimum Author-level access to persist malicious JavaScript payloads by supplying unsanitized content in uploaded image attachment titles. Any site visitor who subsequently loads an affected page triggers execution of the injected script within their browser, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of that user. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; however, the vulnerability is partially unresolved even in the stated boundary version 5.0.7, making the precise remediation target unclear without consulting the referenced patch changesets.
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding the wpamelia-manager role to exfiltrate arbitrary data from the site's database via the Customer Import feature. The flaw stems from unsanitized user-supplied parameters passed into pre-existing SQL queries without adequate escaping or prepared statement usage, enabling stacked or appended query manipulation. No public exploit code or active exploitation has been identified at the time of analysis, and the confidentiality-only impact (C:H/I:N/A:N) reflects read-level database access rather than modification or destruction capability.
Stored Cross-Site Scripting in the SysBasics Customize My Account for WooCommerce plugin (all versions through 4.4.14) allows authenticated shop managers to persist malicious scripts via the unsanitized 'row_type' parameter, executing in any user's browser upon visiting the compromised My Account page. The CVSS scope change (S:C) confirms cross-user impact - injected scripts run in victim sessions, enabling session hijacking or credential theft beyond the attacker's own context. No public exploit code or CISA KEV listing is confirmed at time of analysis; risk is substantially gated by the shop manager privilege requirement.
SQL injection in the WP Bulk Delete WordPress plugin (all versions up to and including 1.4.2) allows authenticated attackers holding administrator-level privileges to append arbitrary SQL to existing queries via the delete_user_roles POST parameter, enabling full database read access. The root cause is a code-level stripping of WordPress's built-in magic-quotes protection: wp_unslash() is called on the raw POST body before parse_str() decomposes it, leaving attacker-controlled values fully unescaped when they reach the SQL sink in class-delete-api.php. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; real-world risk is bounded by the administrator authentication requirement.
Stored Cross-Site Scripting in the wpForo Forum WordPress plugin (all versions through 3.1.1) allows authenticated attackers with subscriber-level access to permanently inject malicious JavaScript via the 'location' profile field. The root failure is WordPress's native sanitize_text_field() function, which strips tags but leaves double quotes unencoded, enabling attribute breakout from an href context into injected event-handler attributes. With a CVSS scope change (S:C), successful exploitation can impact sessions of any user - including administrators - who views a poisoned profile page, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) allows authenticated contributors to inject persistent malicious scripts via the price_wrapper shortcode attribute, due to missing sanitization and output escaping in class.shortcodes.php. A compromised or malicious contributor account can plant the payload in any page or post, where it executes against visiting victims - but only those who carry the referenced ticket ID in their cart cookie, materially narrowing the realistic victim pool. No active exploitation has been confirmed in CISA KEV, and no EPSS data was provided in the intelligence feed.
Authorization bypass in the WPBot AI ChatBot plugin for WordPress (all versions ≤ 8.5.6) permits any subscriber-level authenticated user to invoke the plugin's RAG document re-embedding functionality without authorization, directly modifying the rag_documents database table and triggering calls to the site owner's paid AI APIs (OpenAI, Gemini, OpenRouter, or xAI). The root cause is a missing capability check in class-qcld-bot-rag.php, confirmed by Wordfence and traceable to specific code paths in qcld-wpwbot.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.3 Medium score reflects constrained direct security impact - though financial harm from API credit exhaustion represents the primary real-world risk.
Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself.
Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.
SQL Injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.6) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL to existing queries via the unsanitized 'filtersource' parameter, exposing sensitive data stored in the WordPress database. The flaw originates from insufficient escaping and missing prepared statement usage across multiple display and admin class files identified by Wordfence. No public exploit code or active exploitation has been identified at time of analysis, and the high privilege requirement significantly constrains real-world impact.
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with custom-role access or above to append arbitrary SQL to database queries and extract sensitive information. The attack is split across two phases: a malicious payload is stored during quiz abandonment via the wp_ajax_tutor_quiz_abandon AJAX handler, and the injected SQL fires only when a privileged user or Tutor REST API key holder fetches /wp-json/tutor/v1/quiz-attempt-details/{id}. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
SQL Injection in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) permits authenticated attackers holding a custom-level role or above to append arbitrary SQL to existing queries via the unsanitized 's' search parameter, enabling full database read access. The vulnerability originates in the better-attendees-and-tickets addon (index.php lines 50, 485, and 502) and is confirmed by Wordfence with source code evidence. No active exploitation is confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, keeping real-world urgency moderate despite the High confidentiality impact.
Second-order SQL injection in Quiz Master Next (QSM) for WordPress through version 11.2.0 allows authenticated attackers holding Author-level access to plant SQL payloads in quiz page data that execute whenever any user - including administrators - views the affected quiz's Questions tab. The root cause is a two-stage failure: the qsm_ajax_save_pages() AJAX handler sanitizes user-supplied 'pages' values only with sanitize_text_field() (which strips HTML/PHP tags but does not escape SQL-special characters), then qsm_options_questions_tab_content() at line 143 reconstructs those stored values into an IN() clause via implode() with no $wpdb->prepare() call and no integer casting. No public exploit code has been identified at time of analysis; however, the split-phase attack pattern - where payload planting and execution are decoupled - commonly evades first-order WAF detection and standard code scanning, elevating practical risk beyond the 6.5 CVSS score alone.
Authorization bypass in The Cache Purger WordPress plugin (all versions through 2.3.20) allows any subscriber-level authenticated user to permanently destroy the plugin's entire cache-purge audit log (wp-content/purge.log). The root cause is that the tcp_log_purge nonce - the only credential required to trigger log deletion - is rendered in the WordPress admin bar on frontend pages visible to all authenticated users, including the lowest-privilege subscribers, making the authorization check trivially bypassable. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the WP Delicious (formerly Delicious Recipes) WordPress plugin versions up to and including 1.10.2 allows authenticated Contributor-level users to inject arbitrary JavaScript via unsanitized `javascript:` URIs embedded in recipe step link attributes. The `wrap_direction_text()` function interpolates attacker-controlled `href` values directly into anchor tags using `sprintf()` without invoking WordPress's `esc_url()`, enabling payload execution in the browser of any privileged user who clicks the poisoned link while previewing or viewing the affected recipe post. No CISA KEV listing or public exploit code has been identified at time of analysis, though Wordfence's source-level disclosure provides sufficient detail for independent reproduction.
SQL Injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'sort_field' parameter, exposing sensitive database contents. The vulnerability resides in seo-booster.php (lines 389, 404, 406) where user-supplied sort input is neither escaped nor parameterized before being incorporated into SQL execution. Despite a high confidentiality impact, exploitation is gated behind WordPress administrator-level credentials (PR:H), substantially limiting the realistic attack surface. No public exploit identified at time of analysis; a WordPress Trac changeset (3606177) suggests a patch has been committed.
Time-based SQL injection in the SEO Booster WordPress plugin (versions up to and including 7.3.1) allows authenticated administrators to extract sensitive database contents by manipulating the unquoted 'orderby' parameter in the Google Search Console list table component. The root cause is that developer-applied sanitization functions esc_sql() and sanitize_text_field() fail to neutralize SQL keywords, subquery syntax, commas, or parentheses when used in an ORDER BY clause context, leaving the clause fully attacker-controlled. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS score data was not provided.
Reflected Cross-Site Scripting in the Product Feed Manager For WooCommerce WordPress plugin (all versions through 7.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unescaped 's' search parameter, which executes in a victim's browser upon interaction with a crafted link. The vulnerability is rooted in insufficient sanitization and output escaping within the plugin's admin-facing PHP classes, as confirmed by Wordfence with direct source code references to class-rex-product-feed-actions.php and class-rex-product-feed.php. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Stored Cross-Site Scripting in the Easy Accordion - AI-Powered FAQ & Accordion Blocks, Product FAQ plugin (all versions ≤ 3.1.6) enables authenticated attackers holding contributor-level WordPress roles to inject persistent JavaScript payloads via the unsanitized 'align' block attribute. The injected script executes in the browser of any user - including administrators - who views the affected page, making session hijacking and privilege escalation realistic follow-on impacts. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence source code references pinpoint the exact vulnerable lines, substantially lowering the barrier to exploitation.
SQL injection in MultiVendorX (WooCommerce Multivendor Marketplace) plugin versions up to and including 5.0.9 allows any authenticated WordPress user to extract sensitive data from the database via the unparameterized 'order_by' argument in the transactions REST endpoint. Critically, the default plugin configuration automatically approves store owner registrations, meaning any subscriber-level WordPress account holder can self-elevate to store_owner role via the public Stores REST endpoint, then immediately exploit the injection - effectively lowering the real-world privilege bar to any authenticated user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the default-on privilege escalation path substantially raises exploitability beyond the PR:L CVSS score suggests.
Stored XSS in GiveWP's Sequoia donation template allows authenticated attackers with give worker-level access to inject persistent JavaScript payloads via the 'twitter_message' template setting, affecting all WordPress installations running plugin versions through 4.16.3. The injected payload is not sanitized before being embedded inside a JavaScript template literal in the Sequoia confirmation view's social-sharing component, and executes in the donor's browser specifically when they click the 'Share on Twitter' button after completing a donation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the Wordfence disclosure includes direct source code references confirming the unsanitized evaluation path.
Cross-site request forgery in the Landing Page Builder - Coming Soon Page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin (all versions up to and including 1.5.3.6) allows unauthenticated remote attackers to manipulate arbitrary WordPress posts by sending a forged AJAX request that inherits an authenticated editor or administrator's browser session. Missing nonce validation on the ulpb_admin_ajax function means a victim who clicks a crafted link while logged in unknowingly authorizes post creation, modification of titles, slugs, types, status, and injection of ULPB_DATA post meta. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified; EPSS data was not provided in available intelligence.
Sensitive information exposure in the List Category Posts WordPress plugin (all versions through 0.95.0) allows authenticated contributors to read non-public posts belonging to other users - including pending-review, scheduled, and trashed content with full body text, excerpts, authors, and custom-field metadata. Exploitation requires only a contributor-level account and the ability to embed the native [catlist] shortcode in a draft post, then preview it, triggering the flawed sanitize_status logic. This is a confirmed bypass of the incomplete authorization fix shipped in version 0.93.0 for CVE-2025-11377, indicating the root authorization flaw was never fully remediated. No public exploit code or CISA KEV listing is identified at time of analysis.
Missing authorization in the Catch Themes Demo Import WordPress plugin (versions up to and including 3.3) allows any subscriber-level authenticated user to force-install a hardcoded third-party plugin onto the target WordPress site. The vulnerability exists because catch_themes_demo_import_activate_plugin(), hooked on admin_init, invokes Plugin_Upgrader::install() to fetch and install 'essential-content-types' from WordPress.org before performing the current_user_can('activate_plugins') capability check - a classic authorization-check inversion. No public exploit code has been identified at time of analysis, and the constrained impact (only one hardcoded plugin can be installed, not arbitrary ones) meaningfully limits real-world severity despite the low authentication requirement.
Stored Cross-Site Scripting in the MxChat AI Chatbot & Content Generation WordPress plugin (versions up to and including 3.2.10) enables authenticated administrators to persist malicious scripts through admin settings panels. Exploitation is constrained to WordPress multi-site environments or single-site installs where the unfiltered_html capability has been explicitly disabled, narrowing the realistic attack surface significantly. No public exploit code or active exploitation (CISA KEV) has been identified; CVSS 4.4 Medium reflects the restricted conditions and high privilege requirement.
Insecure Direct Object Reference in the Academy LMS WordPress plugin (all versions through 3.8.0) allows authenticated attackers with Subscriber-level access to read, overwrite, or delete the private lesson notes of any user - including administrators - and to falsify lesson-completion records for arbitrary accounts. Three AJAX handlers (save_lesson_note, get_lesson_note, complete_lesson_video) perform no ownership validation on a user-controlled key, making cross-user data manipulation trivially achievable by any registered site user. No public exploit identified at time of analysis, but the attack surface is fully described via Wordfence's public threat-intelligence entry and source-level code references.
Stored Cross-Site Scripting in WP Customer Area WordPress plugin (versions up to and including 8.3.5) allows authenticated attackers with Contributor-level access or above to persistently inject arbitrary JavaScript via the unsanitized 'type' attribute of the customer-area-protected-content shortcode. The injected payload executes in the browser of any user who visits the compromised page, enabling session hijacking, credential theft, or malicious redirects against site visitors. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; however, the Contributor-level prerequisite is a low barrier in multi-author WordPress environments.
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
Unauthorized account self-registration in the FoodBook Lite WordPress plugin through version 1.5.6 allows unauthenticated remote attackers to create 'customer'-role accounts and obtain valid WordPress authentication cookies, even when the site administrator has explicitly disabled user registration. The flaw exists because the plugin's registration() function is registered on the publicly accessible wp_ajax_nopriv_registration_action AJAX hook and calls wp_insert_user() without performing nonce verification, capability checks, or consulting the users_can_register site option. No public exploit has been identified at time of analysis and no KEV listing exists; Wordfence reported the issue with a confirmed fix in version 1.5.7.
Sensitive information exposure in the Smart Slider 3 WordPress plugin (all versions up to and including 3.5.1.37) allows authenticated Contributor-level users to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts belonging to any user on the site - including Administrators and Editors - via the unsecured 'keyword' Ajax parameter. The attack barrier is further lowered because the required nonce is automatically emitted on /wp-admin/post-new.php, a page accessible to any Contributor by default through the edit_posts capability, making nonce acquisition trivial. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Missing authorization controls in the Car Rental Manager WordPress plugin (≤1.3.7) allow unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited integrity impact. The CVSS vector (PR:N/UI:N) confirms exploitation requires no credentials or user interaction against any publicly reachable WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world risk at a moderate level despite the trivial exploitation conditions.
Unauthenticated sensitive data exposure in Crocoblock JetSearch WordPress plugin (all versions through 3.6.1.2) permits remote attackers to retrieve embedded sensitive system information without any credentials or user interaction. The flaw is classified under CWE-497, indicating the plugin surfaces internal system data through an externally accessible vector. With a network-accessible, zero-privilege attack path confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, any internet-facing WordPress installation running a vulnerable JetSearch version is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in the Church Admin WordPress plugin (versions through 5.0.30) allows unauthenticated remote attackers to invoke plugin endpoints and perform unauthorized write operations without authentication. The root cause is incorrectly configured access control security levels (CWE-862), where certain plugin actions omit the required capability or nonce checks. No public exploit code or active exploitation has been identified at time of analysis, though the zero-barrier CVSS vector (PR:N, AC:L, AV:N) means opportunistic abuse is technically straightforward for any attacker who can reach the WordPress instance.