Wordpress Plugin
Monthly
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits any authenticated subscriber to extract sensitive data from the underlying WordPress database. The CVSS 8.5 score with Scope:Changed reflects that the database read extends beyond the plugin's own tables, potentially exposing WordPress user credentials, site options, and other privileged data. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17) lets remote unauthenticated attackers (PR:N) inject arbitrary SQL through the plugin's statistics-handling code, enabling extraction of database contents such as user records and password hashes. The flaw is network-reachable with low complexity and no user interaction (CVSS 9.3, S:C/C:H). No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical but the barrier is low.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in WP Fastest Cache (WordPress plugin, all versions through 1.5.0) allows unauthenticated remote attackers to inject persistent JavaScript by supplying a crafted HTTP Host header that the plugin writes into shared page-cache files, which are then served to all subsequent visitors. Exploitation requires two co-present non-default conditions: the Polylang or Polylang Pro multilingual plugin must be installed and active, and the 'Combine JS' option must be enabled in WP Fastest Cache settings, both of which activate the vulnerable Host-header-to-URL code path in js-utilities.php. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Subscriber-level privilege escalation in the Booking Hub WordPress plugin (versions ≤ 1.3.0) allows authenticated users with only subscriber-level access to elevate their privileges to administrator-equivalent roles. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation with full confidentiality, integrity, and availability impact once a low-privilege account is obtained. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic priority for any WordPress site running the affected plugin with user registration enabled.
Local File Inclusion in MagicAI for WordPress (versions up to and including 1.4) allows authenticated subscribers to include arbitrary PHP files from the server's filesystem by manipulating user-controlled input that is passed to a PHP file-inclusion function without adequate path validation. With CVSS 8.8 (High) and network-accessible exploitation requiring only subscriber-level authentication, this flaw grants attackers full confidentiality, integrity, and availability impact over the affected WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets remote attackers inject arbitrary SQL through an unauthenticated request, exposing the WordPress database on any internet-facing site running the plugin. The CVSS 3.1 base score is 9.3 (critical) with a changed-scope, confidentiality-focused vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical, but the barrier to abuse is low.
Unauthenticated SQL injection in WooBeWoo Product Filter Pro (a WooCommerce catalog-filtering plugin) affects all versions up to and including 3.1.8, allowing remote attackers with no authentication to inject arbitrary SQL into backend queries and read sensitive database contents such as WordPress user records, password hashes, and session tokens. Reported by Patchstack and carrying a CVSS 9.3 (CWE-89), the flaw is network-exploitable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQLi in WordPress plugins is historically a high-value, easily-weaponized target.
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Unauthenticated privilege escalation in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin (versions up to and including 8.9.1) lets remote, unauthenticated attackers improperly acquire elevated privileges on affected WordPress sites. Reported by Patchstack and tracked as EUVD-2026-64804, the flaw carries a critical CVSS 9.8 with a fully network-exploitable vector and no user interaction. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated nature make it a high-priority patching target.
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file deletion in ShopBuilder Pro - Elementor WooCommerce Builder Addons plugin versions 2.2.0 and earlier allows any remote attacker to delete arbitrary files on the underlying WordPress server without credentials. The root cause is a path traversal weakness (CWE-22) in a network-exposed endpoint that fails to sanitize user-supplied file paths, enabling traversal outside the plugin's intended file scope. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the trivial exploitation conditions (no authentication, no user interaction) make this a high-priority patching target for any site running the affected plugin.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated privilege escalation in the Digits WordPress plugin (versions 9.2 and earlier by UnitedOver, LLC) allows remote attackers to elevate their privileges without any authentication or user interaction, per Patchstack's disclosure. Digits is an OTP/phone-based login and registration plugin, so a flaw in its privilege-handling logic can let an outsider gain elevated account access. CVSS is rated 9.8 (critical); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352).
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though Patchstack's disclosure confirms it is reproducible.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Locatoraid Store Locator WordPress plugin (versions 3.9.72 and earlier) lets remote attackers inject arbitrary SQL through the plugin's request handling, exposing the underlying WordPress database. The flaw is reachable without any authentication (PR:N) and carries a high CVSS of 9.3 with a changed scope, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Directory Pro WordPress plugin (versions 2.5.8 and earlier by e-plugins) lets remote unauthenticated attackers inject arbitrary SQL through unsanitized input, per the CVSS:3.1 vector (PR:N/UI:N), enabling database extraction against affected sites. Reported by Patchstack and rated 9.3 (Critical) with a scope-change (S:C) component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is driven by the trivial network-based attack profile rather than confirmed exploitation.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits any authenticated subscriber to extract sensitive data from the underlying WordPress database. The CVSS 8.5 score with Scope:Changed reflects that the database read extends beyond the plugin's own tables, potentially exposing WordPress user credentials, site options, and other privileged data. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17) lets remote unauthenticated attackers (PR:N) inject arbitrary SQL through the plugin's statistics-handling code, enabling extraction of database contents such as user records and password hashes. The flaw is network-reachable with low complexity and no user interaction (CVSS 9.3, S:C/C:H). No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical but the barrier is low.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored Cross-Site Scripting in WP Fastest Cache (WordPress plugin, all versions through 1.5.0) allows unauthenticated remote attackers to inject persistent JavaScript by supplying a crafted HTTP Host header that the plugin writes into shared page-cache files, which are then served to all subsequent visitors. Exploitation requires two co-present non-default conditions: the Polylang or Polylang Pro multilingual plugin must be installed and active, and the 'Combine JS' option must be enabled in WP Fastest Cache settings, both of which activate the vulnerable Host-header-to-URL code path in js-utilities.php. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in ShopEngine (all versions up to and including 4.9.4) allows Shop Manager-level authenticated users to achieve full WordPress site takeover by injecting arbitrary core options through a malicious WXR import file. The plugin's `rum_importer()` function is hooked to the WordPress core `import_start` action without any plugin-owned capability check or allowlist filtering, meaning attacker-controlled `<wp_option>` pairs from a crafted import file flow directly into `update_option()` - enabling manipulation of `users_can_register` and `default_role` to open administrator self-registration. No CISA KEV listing or EPSS score was present in the provided data; exploitation requires an existing Shop Manager account and WooCommerce's grant of the `import` capability to that role, but once those conditions are met the path to full site compromise is straightforward and documented.
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Subscriber-level privilege escalation in the Booking Hub WordPress plugin (versions ≤ 1.3.0) allows authenticated users with only subscriber-level access to elevate their privileges to administrator-equivalent roles. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation with full confidentiality, integrity, and availability impact once a low-privilege account is obtained. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic priority for any WordPress site running the affected plugin with user registration enabled.
Local File Inclusion in MagicAI for WordPress (versions up to and including 1.4) allows authenticated subscribers to include arbitrary PHP files from the server's filesystem by manipulating user-controlled input that is passed to a PHP file-inclusion function without adequate path validation. With CVSS 8.8 (High) and network-accessible exploitation requiring only subscriber-level authentication, this flaw grants attackers full confidentiality, integrity, and availability impact over the affected WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets remote attackers inject arbitrary SQL through an unauthenticated request, exposing the WordPress database on any internet-facing site running the plugin. The CVSS 3.1 base score is 9.3 (critical) with a changed-scope, confidentiality-focused vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical, but the barrier to abuse is low.
Unauthenticated SQL injection in WooBeWoo Product Filter Pro (a WooCommerce catalog-filtering plugin) affects all versions up to and including 3.1.8, allowing remote attackers with no authentication to inject arbitrary SQL into backend queries and read sensitive database contents such as WordPress user records, password hashes, and session tokens. Reported by Patchstack and carrying a CVSS 9.3 (CWE-89), the flaw is network-exploitable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQLi in WordPress plugins is historically a high-value, easily-weaponized target.
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Unauthenticated privilege escalation in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin (versions up to and including 8.9.1) lets remote, unauthenticated attackers improperly acquire elevated privileges on affected WordPress sites. Reported by Patchstack and tracked as EUVD-2026-64804, the flaw carries a critical CVSS 9.8 with a fully network-exploitable vector and no user interaction. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated nature make it a high-priority patching target.
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.
SQL Injection in WP Project Manager Pro versions 4.0.1 and below allows authenticated subscriber-level users to execute arbitrary SQL queries against the WordPress database, potentially exposing the full database contents including credentials and sensitive user data. The vulnerability carries a CVSS 8.5 (High) with scope change, meaning exploitation reaches beyond the plugin itself to the underlying WordPress database. Reported by Patchstack and tracked as EUVD-2026-64802; no active exploitation (CISA KEV) has been confirmed, and no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file deletion in ShopBuilder Pro - Elementor WooCommerce Builder Addons plugin versions 2.2.0 and earlier allows any remote attacker to delete arbitrary files on the underlying WordPress server without credentials. The root cause is a path traversal weakness (CWE-22) in a network-exposed endpoint that fails to sanitize user-supplied file paths, enabling traversal outside the plugin's intended file scope. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the trivial exploitation conditions (no authentication, no user interaction) make this a high-priority patching target for any site running the affected plugin.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
SQL injection in the ProLancer Element WordPress plugin (≤1.4.8) enables subscriber-level authenticated users to execute arbitrary SQL queries against the WordPress database, with a scope change indicating access beyond the plugin's own data boundary. Reported by Patchstack and corroborated by ENISA EUVD-2026-64799, the flaw requires only the lowest WordPress user role, making it exploitable on any site with open subscriber registration. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the ProLancer Element WordPress plugin (themebing) affects all versions up to and including 1.4.8, allowing any authenticated subscriber-level user to invoke privileged plugin functionality without proper authorization. The flaw stems from missing authorization checks (CWE-862), yielding high integrity impact and low availability impact against affected WordPress installations. No active exploitation or public exploit code has been identified at time of analysis; Patchstack has published the disclosing advisory.
Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.
Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated privilege escalation in the Digits WordPress plugin (versions 9.2 and earlier by UnitedOver, LLC) allows remote attackers to elevate their privileges without any authentication or user interaction, per Patchstack's disclosure. Digits is an OTP/phone-based login and registration plugin, so a flaw in its privilege-handling logic can let an outsider gain elevated account access. CVSS is rated 9.8 (critical); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Broken access control in the Notification Master WordPress plugin (versions ≤ 1.7.1) exposes restricted functionality to unauthenticated remote attackers, resulting in high confidentiality impact with no authentication required. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that any network-accessible attacker can trigger the flaw with low complexity, likely exposing sensitive notification configuration data such as subscriber email addresses, phone numbers, or webhook endpoints stored by the plugin. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Authentication bypass in the WordPress plugin "Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code" (versions ≤ 4.8.6) lets unauthenticated attackers take over any account, including administrators. The flaw stems from handle_email_otp_return() returning the secret magic login token directly in the HTTP response to a public OTP request instead of emailing it only to the user, so anyone who knows a target's email address can complete login. No public exploit identified at time of analysis, but the trigger is trivial and requires only a known email address.
Cross-Site Request Forgery in HashThemes Easy Elementor Addons (WordPress plugin) affects all versions up to and including 2.3.7, letting a remote attacker forge state-changing requests that are executed with a victim administrator's privileges when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack (CVE-2026-28164 / EUVD-2026-63327) with a vendor-assigned CVSS of 9.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on tricking an authenticated user into triggering the forged request, since the plugin fails to validate request authenticity (CWE-352).
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though Patchstack's disclosure confirms it is reproducible.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Locatoraid Store Locator WordPress plugin (versions 3.9.72 and earlier) lets remote attackers inject arbitrary SQL through the plugin's request handling, exposing the underlying WordPress database. The flaw is reachable without any authentication (PR:N) and carries a high CVSS of 9.3 with a changed scope, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Directory Pro WordPress plugin (versions 2.5.8 and earlier by e-plugins) lets remote unauthenticated attackers inject arbitrary SQL through unsanitized input, per the CVSS:3.1 vector (PR:N/UI:N), enabling database extraction against affected sites. Reported by Patchstack and rated 9.3 (Critical) with a scope-change (S:C) component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is driven by the trivial network-based attack profile rather than confirmed exploitation.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.