Wordpress Plugin
Monthly
Cross-Site Request Forgery in FastPicker (versions up to and including 1.0.2), a WooCommerce order management plugin for WordPress, allows unauthenticated remote attackers to modify the plugin's administrative settings by tricking a logged-in site administrator into clicking a crafted link. Specifically, the `settingsPage` function in `Admin.php` lacks proper nonce validation, enabling forged POST requests that can toggle the plugin's webhook integration and redirect FastPicker and KDZ API endpoint URLs to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-Site Request Forgery combined with stored XSS in the WP Emoticon Rating WordPress plugin (all versions ≤ 1.0.1) allows unauthenticated remote attackers to persistently inject malicious scripts into site settings by tricking a logged-in administrator into clicking a crafted link. The CVSS Scope:Changed rating reflects that the injected payload executes beyond the admin context, potentially affecting all site visitors. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X
Stored Cross-Site Scripting in the WP ApplicantStack Jobs Display WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Because the CVSS vector reflects Changed Scope (S:C), successful injection impacts the browsers of any user - including administrators - who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA KEV.
Stored Cross-Site Scripting in the WP GDPR Cookie Consent WordPress plugin (versions up to and including 1.0.0, by techjewel) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into pages served to all site visitors. The vulnerability chains three distinct weaknesses in the handleAjaxCalls() function: absent capability verification, missing nonce validation, and unsanitized gdprConfig values that are echoed verbatim by generateCSS() into a <style> block on wp_head. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber-level) and changed scope (S:C) make this a meaningful risk for multi-user WordPress sites.
Stored Cross-Site Scripting in the ePaperFlip Publisher WordPress plugin (all versions up to and including 1) permits authenticated Contributors to inject arbitrary JavaScript via the 'publicationid' attribute of the epaperflip_embed shortcode, which is written unsanitized directly into inline JavaScript on rendered pages. The CVSS Changed scope (S:C) reflects that the injected payload executes in the browser context of any visitor who loads the compromised page, crossing trust boundaries beyond the plugin itself. No public exploit code has been identified at time of analysis and this vulnerability is not currently listed in the CISA KEV catalog.
Cross-Site Request Forgery in the AJAX Report Comments WordPress plugin (≤2.0.4) allows unauthenticated attackers to modify plugin settings by tricking a logged-in administrator into triggering a forged request. The rc_options_page function in report-comments.php performs missing or incorrect nonce validation, enabling an attacker to overwrite notification email addresses, comment thresholds, link text, and message bodies without any privileges of their own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the notification email hijack vector makes this a meaningful integrity risk on affected sites.
Cross-Site Request Forgery combined with reflected XSS in the WpMobi WordPress plugin (all versions through 0.0.3) allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser session by forging a settings-save request. The handleSaveGeneralSettings function performs no nonce validation, permitting any remote party to submit crafted plugin settings on behalf of an authenticated admin. A particularly notable aspect is that the injected script in the app_name parameter fires even when server-side validation rejects the value, because the view layer re-renders the form with the unsanitized in-memory value rather than a sanitized fallback - meaning the XSS trigger does not depend on successful data persistence. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the RomanCart Ecommerce WordPress plugin (versions ≤2.0.8) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via the 'blclass' attribute - and other attributes - of the romancart_button shortcode. The injected payload executes in any visitor's browser upon page load, enabling session hijacking, credential theft, or administrative account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and changed scope (S:C) elevate real-world concern for multi-author WordPress deployments.
WP-Ultimate-Map plugin for WordPress (versions up to and including 1.1) is vulnerable to a chained CSRF-to-stored-XSS attack that allows unauthenticated network attackers to hijack plugin settings and inject persistent JavaScript into the WordPress admin panel. The missing nonce check on `process_init()` - hooked to `admin_init` - means any forged POST with a `save-setting` parameter will overwrite plugin options without any authentication or state validation. The injected `zoom-level` value is then stored unsanitized and reflected verbatim into an HTML attribute and inline JavaScript block on the settings page, completing the XSS chain. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the TinyMCE Shortcode Addon WordPress plugin (all versions ≤ 1.0.0) allows authenticated attackers with contributor-level access or higher to inject persistent JavaScript via the unsanitized 'btnrel' shortcode attribute. The injected script is stored server-side and executes in the browser of every subsequent visitor to the affected page, including administrators - enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated settings manipulation in Helpfulcrowd Product Reviews plugin for WordPress (versions up to and including 1.2.9) allows any remote attacker to overwrite arbitrary plugin configuration values in the WordPress database. The vulnerability stems from a PHP type juggling flaw in the token validation function combined with an openly accessible REST endpoint registered with `__return_true` as its permission callback. By submitting a JSON boolean `true` as the token value, an attacker bypasses the loose-comparison check (`!=`) in `helpfulcrowd_validate_token()` and gains full write access to the `helpfulcrowd_options` database option with no sanitization or allowlist enforcement. No public exploit or CISA KEV listing is identified at time of analysis.
Cross-Site Request Forgery in WP Meta Sort Posts WordPress plugin (all versions ≤ 0.9) allows unauthenticated remote attackers to modify plugin settings by tricking a logged-in administrator into clicking a crafted link, due to missing nonce validation in msp-options.php. The CVSS vector (PR:N, UI:R) confirms the attacker requires no authentication but must social-engineer an administrator, with impact limited to changing the msp_loop_file and msp_nav_location settings. No active exploitation confirmed - this CVE is not listed in CISA KEV, no public exploit code has been identified, and EPSS data was not provided in available intelligence.
Stored Cross-Site Scripting in the Global Body Mass Index Calculator WordPress plugin (versions up to and including 1.2) allows authenticated contributors to persistently inject arbitrary JavaScript into any page rendering the 'gbmicalc' shortcode. The vulnerability arises from PHP's @extract() call on unsanitized shortcode attributes followed by unescaped output into both an HTML style attribute context and an HTML body context inside GBMI_Calc_Widget::widget(), enabling attribute-breakout payloads. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the Wordfence-confirmed contributor-level requirement makes this a realistic risk for any multi-author WordPress installation.
Stored Cross-Site Scripting in the Extra Settings for RocketChat WordPress plugin (versions up to and including 0.1) allows authenticated attackers with contributor-level access to permanently inject arbitrary JavaScript via the 'title' attribute of the [rocketchat] shortcode. The injected script persists in the database and executes in the browser of any site visitor who loads an affected page, enabling session hijacking, credential theft, or further privilege escalation depending on victim role. No public exploit code identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Stored Cross-Site Scripting in WPZOOM's Recipe Card Blocks Lite WordPress plugin (all versions through 3.4.13) allows authenticated attackers with Author-level access or higher to inject persistent malicious scripts into published posts and recipe print views. The vulnerability is a sanitization bypass: the `WPZOOM_Helpers::deserialize_block_attributes` method re-decodes unicode-escaped character sequences back into raw HTML after WordPress's sanitization pipeline has already run, permitting crafted payloads in the recipe block's 'summary' and 'notes' attributes to survive sanitization and execute in victims' browsers. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Changed Scope (S:C) rating reflects cross-user impact, including potential administrator session hijacking.
WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin WP-Paginate 2.1.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the preset parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Time-based SQL injection in the Photo Gallery by 10Web WordPress plugin (all versions through 1.8.41) enables authenticated contributors to exfiltrate arbitrary data from the WordPress database via a stored shortcode payload that is subsequently triggered without authentication. The attack exploits the 'compact_album_order_by' parameter passed through the 'shortcode_bwg' AJAX handler, where insufficient escaping and absent query preparation allow appended SQL clauses to survive into execution. Critically, the stored malicious shortcode can be activated by the unauthenticated 'bwg_frontend_data' AJAX handler, collapsing the effective authentication barrier after the initial store step. No public exploit code or CISA KEV listing has been identified at time of analysis.
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in WP Maps (all versions through 4.9.4) allows authenticated attackers holding the wpgmp_manage_location capability - granted to administrators by default but delegable to lower-privileged roles - to inject persistent malicious scripts via the 'location_messages' parameter. The CVSS scope change (S:C) confirms the injected payload executes across victim browser sessions on any page rendering the affected shortcode, enabling session hijacking or unauthorized actions on behalf of site visitors. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the delegable capability expands the potential attacker pool beyond pure administrators.
Insecure Direct Object Reference in the Klamra Paycal for Aspaclaria WordPress plugin (all versions through 1.1.4) allows authenticated attackers with subscriber-level access to download invoices belonging to other customers by enumerating sequential WordPress post IDs via the unvalidated 'invoice_id' parameter. Exposed data includes full name, email address, phone number, order total, line items, and customer notes - constituting a significant billing PII breach for any e-commerce site running this plugin. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV, but the low attack complexity and sequential enumeration method make mass harvesting of customer data straightforward for any authenticated user.
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated REST endpoint that leaks map data including POI titles, physical addresses, and coordinates for any map by ID enumeration, and an authenticated write surface where any Contributor-level user can modify, delete, clone, or trash maps they do not own. All versions through 2.96.6 are affected. No public exploit is confirmed exploited in the wild (not in CISA KEV), though Wordfence has published a public advisory and exploit information is available, and SSVC classifies the write path as automatable.
Authorization bypass in the Squirrly SEO WordPress plugin (all versions through 12.4.16) allows authenticated attackers with contributor-level access to invoke privileged Squirrly cloud API operations reserved for administrators, including revoking the site's Google Search Console and Google Analytics integrations via the `api/gsc/revoke` and `api/ga/revoke` endpoints. The flaw stems from the plugin's failure to verify the `sq_manage_settings` capability before processing these state-changing cloud API calls, meaning any contributor can silently destroy critical SEO and analytics data connections without administrator knowledge. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SQL Injection in OptinCraft (Drag & Drop Optins & Popup Builder for WordPress) versions up to and including 1.2.0 allows authenticated attackers with administrator-level access to extract sensitive data from the underlying WordPress database. The vulnerability exists in the 'order_by' parameter, which is passed without sufficient escaping or parameterized query preparation through the plugin's internal SQL compiler, enabling appending of arbitrary SQL to existing queries. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high confidentiality impact and network-accessible attack vector make it a meaningful data-disclosure risk in multi-administrator WordPress environments.
Unauthenticated webhook forgery in WPForms (wpforms-lite ≤1.10.0.1) enables payment fraud by allowing any remote attacker who knows a valid PayPal subscription_id to manipulate subscription payment records - including forcing a cancelled or suspended subscription back to active status - without any credentials or user interaction. The PayPal Commerce webhook endpoint accepts and acts on arbitrary JSON POST payloads, performing no HMAC-SHA256 origin verification, and trusts attacker-supplied resource data once the event_type field passes a whitelist check. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the zero-complexity attack path makes independent exploitation straightforward for anyone possessing a valid subscription_id.
Path traversal in the Quick Playground WordPress plugin (versions ≤ 1.3.4) exposes arbitrary server files to authenticated administrators. The flaw exists in client-qckply_data.php where the qckply_data() function forwards a user-supplied filename POST parameter directly into file_get_contents() without sanitization, enabling traversal sequences to escape the webroot and reach files such as wp-config.php or /etc/passwd. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, but exploitation would yield database credentials and other secrets with high confidentiality impact.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Stored Cross-Site Scripting in the Click to Chat - WA Widget WordPress plugin (holithemes, all versions through 4.38) allows authenticated Contributor-level users to inject persistent JavaScript payloads that execute in victim browsers when the rendered WhatsApp chat button is clicked. The root cause is a double-encoding bypass: esc_attr() sanitization produces HTML entities that are decoded back to literal characters by the browser's HTML parser before JavaScript evaluation inside an onclick event handler, completely defeating the intended escaping. No public exploit has been identified at time of analysis, but the detailed technical write-up from Wordfence combined with publicly browsable vulnerable source code significantly lowers the barrier to exploitation. Vendor-released patch version 4.39 is available.
PHP Object Injection in the LearnPress - Backup & Migration Tool WordPress plugin (versions ≤ 4.1.4, by ThimPress) allows authenticated administrators to supply maliciously crafted serialized data through the plugin's import functionality, triggering unsafe PHP deserialization. The vulnerability itself carries no direct impact in isolation - exploitation is contingent on a separate plugin or theme installing a usable POP (Property-Oriented Programming) chain on the same site, at which point an attacker can escalate to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 6.6 (High complexity, High privileges required) reflects the constrained real-world conditions.
Directory traversal in the LearnPress - Backup & Migration Tool plugin for WordPress (all versions through 4.1.4) allows authenticated administrators to read arbitrary files on the underlying server by supplying path traversal sequences via the 'import-user-file' parameter. Exploitation exposes highly sensitive server-side content - including wp-config.php database credentials, private keys, or system files - despite requiring high-privilege access. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. The CVSS score of 4.9 reflects the high privilege barrier (PR:H), but the C:H confidentiality impact makes successful exploitation consequential.
Reflected XSS in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin (all versions through 2.8.15) enables unauthenticated attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs targeting pages where iframe mode is active. The vulnerability exists because URL parameters passed through the plugin's iframe rendering path (class.php lines 3460, 3462, 3470) are insufficiently sanitized before output. Exploitation is contingent on a non-default configuration (iframe mode enabled) and requires social engineering to make a user click a crafted link, but no public exploit code has been identified at time of analysis.
Directory traversal in the Smart Slider 3 WordPress plugin (all versions ≤ 3.5.1.36) exposes arbitrary server-side files to authenticated administrators via the replaceHTMLImage function in the plugin's slider export/backup subsystem. An attacker with administrator-level WordPress access can craft a request that traverses outside the intended directory and return the raw contents of sensitive files such as wp-config.php. No public exploit or CISA KEV listing exists at time of analysis, and the high privilege requirement (CVSS PR:H) substantially limits the realistic attack surface to insider threats, compromised admin accounts, or privilege-escalation chains.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.
Stored Cross-Site Scripting in the Master Addons for Elementor WordPress plugin (versions up to and including 3.1.0) allows authenticated attackers with author-level access to inject persistent JavaScript into pages by exploiting a broken authorization boundary in the Custom JS Extension. The flaw arises because the unfiltered_html capability check is enforced only during UI rendering (Elementor control registration) and entirely absent from the save handler, permitting a crafted POST to admin-ajax.php?action=elementor_ajax to store arbitrary scripts that execute in every subsequent visitor's browser. No public exploit or CISA KEV listing has been identified at time of analysis, though the Wordfence disclosure and direct source-code references confirm the issue is well-documented.
Missing authorization in the Page-list WordPress plugin (all versions up to and including 6.2) allows authenticated contributors to read private and draft page content beyond their intended access scope. The [pagelist_ext] shortcode in the pagelist_unqprfx_ext_shortcode() function passes attacker-supplied post_status, post_type, and show_meta_key attributes directly into get_pages() and get_post_meta() with no capability check, and a critical amplification trigger - when no child pages exist, the query falls back to child_of => 0, broadening scope to every matching page on the entire site. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and straightforward exploitation path via shortcode injection make this a meaningful insider-threat risk on sites with sensitive unpublished content.
Authorization bypass in the Alba Board WordPress plugin (all versions through 2.1.3) exposes private project card data to unauthorized access. Despite the CVSS vector assigning PR:L (low privileges required), the vulnerability description explicitly reveals a more severe exploitation path: the AJAX handler is registered under the wp_ajax_nopriv_ hook, and the required nonce is broadcast to all site visitors via wp_localize_script on any page rendering the [alba_board] shortcode - enabling fully unauthenticated access to private alba_card records including titles, descriptions, assignees, due dates, tags, and comments. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the vulnerable code path is publicly browsable in the WordPress plugin repository.
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Soliloquy Lite 2.5.6 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive data exposure in the WP eMember WordPress plugin (Tips and Tricks HQ) through version 10.2.2 allows unauthenticated remote attackers to retrieve embedded sensitive system information via a network request. The vulnerability is classified under CWE-497, meaning internally sensitive data is reachable from an unauthorized control sphere - in this case, the open internet without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation probability from EPSS data was not provided, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially reachable from any network source.
Privilege escalation in the Mojoomla School Management WordPress plugin (versions up to and including 93.2.0) allows authenticated low-privileged users to elevate their permissions to higher-privileged roles such as administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 3.1 score of 8.8 with no public exploit identified at time of analysis. Any WordPress site running the plugin in its default state is vulnerable until an upstream patch is released.
SQL injection in Mojoomla School Management plugin for WordPress (versions up to and including 93.2.0) allows high-privileged authenticated attackers to inject crafted SQL through unsanitized input, leading to confidentiality compromise of the underlying database and limited availability impact. The scope-changed CVSS 7.6 rating reflects that exploitation can affect resources beyond the vulnerable component, such as the shared WordPress database hosting other plugins or sites. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting in Fox-themes Prague (WordPress theme/plugin family) through version 2.2.8 lets a remote attacker inject script that executes in a victim's browser when the victim clicks an attacker-crafted link. The flaw was disclosed via Patchstack and carries a CVSS 7.1 (scope-changed) rating; no public exploit identified at time of analysis and the issue is not on CISA KEV.
Missing authorization controls in the Elementor Website Builder WordPress plugin through version 4.1.0 allow low-privilege authenticated users to exploit incorrectly configured access control levels, resulting in limited unauthorized read and write access to restricted plugin functionality. The flaw (CWE-862) means the plugin fails to validate whether the authenticated requestor holds sufficient WordPress capabilities before granting access to protected operations. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity makes this straightforward to exploit once a valid account is obtained.
Stored XSS in the Progress Planner WordPress plugin (versions through 1.9.0) enables a high-privileged attacker to inject persistent malicious scripts into web pages served to other users. Because the scope is marked Changed (S:C), the injected payload executes in the context of lower-privileged site visitors, not just the attacker's session, crossing the admin-to-user security boundary. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Crew HRM WordPress plugin (versions through 1.2.2) permits authenticated low-privileged users to invoke plugin functionality beyond their intended authorization level, resulting in limited unauthorized data modification and availability impact. The flaw, rooted in CWE-862 Missing Authorization, means the plugin fails to validate whether the requesting user holds the required WordPress capability before executing sensitive operations. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Local file inclusion in the UnboundStudio Accordion FAQ WordPress plugin (versions up to and including 2.2.1) allows authenticated remote attackers to include and execute arbitrary PHP files from the server filesystem via improperly controlled include/require statements. The flaw, reported by Patchstack and tagged as LFI/Information Disclosure, can lead to full compromise of the WordPress instance through disclosure of sensitive configuration data (e.g., wp-config.php) and potential code execution if attacker-controlled files are reachable. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in the ThimPress Thim Core WordPress plugin (all versions through 2.3.3) allows authenticated low-privileged users to perform actions exceeding their intended permission level due to improperly enforced access control checks. The flaw, classified as CWE-862 (Missing Authorization), results in unauthorized integrity-impacting operations without requiring administrative credentials, as confirmed by the CVSS vector (PR:L/I:L). No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Privilege-bound arbitrary code execution in ThimPress Thim Core (WordPress plugin) versions through 2.3.3 allows authenticated low-privilege users to bypass authorization checks and execute arbitrary code on affected sites, per Patchstack's advisory tagging this as an authentication bypass leading to RCE. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity over the network. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Themeisle Masteriyo LMS PRO (WordPress plugin) up to and including version 2.20.0 allows remote unauthenticated attackers to gain elevated privileges through incorrect privilege assignment (CWE-266). The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis, but the Patchstack advisory confirms the flaw class and affected version range.
Missing Authorization in the Printeers Print & Ship WordPress plugin (versions through 1.17.0) allows authenticated low-privileged users to perform actions that should be restricted to higher-privileged roles, resulting in high-integrity impact against affected WordPress sites. The flaw is classified under CWE-862 and reported by Patchstack as an incorrectly configured access control security level, meaning the plugin fails to enforce proper capability checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the moderate-priority tier for WordPress site operators running the affected plugin.
Reflected cross-site scripting in the UnboundStudio Accordion FAQ WordPress plugin (versions through 2.2.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser session by luring them to click a crafted link. The CVSS 7.1 score reflects scope change (S:C), meaning script execution can affect resources beyond the vulnerable component, such as the WordPress admin context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Tiled Gallery Carousel Without JetPack WordPress plugin (versions up to and including 3.1) allows authenticated attackers with contributor-level access to inject persistent malicious JavaScript via the 'data-image-title' parameter. The injected script executes in victims' browsers each time an affected gallery page is visited, enabling session theft, credential harvesting, or malicious redirects against site visitors and administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the low privilege barrier (contributor access) broadens the potential attacker pool on sites with open registration.
Cross-Site Request Forgery in the Laiser Tag WordPress plugin (versions up to and including 1.2.5) allows unauthenticated remote attackers to overwrite critical plugin settings - including API keys, tag blacklists, relevance thresholds, batch sizes, and tagging toggles - by tricking a logged-in site administrator into clicking a crafted link. The root cause is missing or incorrect nonce validation on the addOptionsPageFields function, as identified by Wordfence and corroborated by source references pointing to Tagging.php and adminOptionPage.php in the plugin's trunk. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world exploitation opportunity relatively constrained by the required administrator interaction.
Cross-Site Request Forgery in the Remove Meta Boxes Per User Role WordPress plugin (all versions ≤1.01) enables unauthenticated remote attackers to modify or reset per-role admin dashboard meta box visibility settings by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation on the plugin's settings page, which is the standard WordPress anti-CSRF mechanism. No public exploit has been identified and the issue is not listed in CISA KEV; real-world impact is limited to low-integrity administrative configuration tampering.
Reflected Cross-Site Scripting in the rognone plugin for WordPress (versions up to and including 0.6.2) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link containing a malicious 'a' parameter. The vulnerability originates in header.php at line 74, where user-supplied input is reflected into page output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Cross-Site Request Forgery in the Remove NoFollow Commenter URL WordPress plugin (all versions ≤ 1.0) allows unauthenticated remote attackers to modify the plugin's comment-display settings by tricking a logged-in site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation in the `gmz_comment_settings_save` function, meaning the plugin accepts state-changing POST requests without verifying they originated from a legitimate admin session. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the required user interaction as a meaningful limiting factor.
Stored Cross-Site Scripting in the Word Replacer WordPress plugin (versions up to and including 0.4) allows authenticated attackers with Administrator-level access to persist arbitrary JavaScript payloads via the 'replacement' parameter, which subsequently execute in the browsers of any user visiting an affected page. Reported by Wordfence, the root cause is insufficient input sanitization and output escaping in word-replacer.php at multiple code locations (lines 191, 230, 339, 343). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Tectite Forms WordPress plugin (all versions through 1.3) allows unauthenticated remote attackers to modify plugin settings by inducing an authenticated administrator to click a crafted link. The vulnerable surface is the admin_init function, which lacks proper nonce validation (CWE-352), permitting forged requests to alter options such as tectite_forms_button. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the DeMomentSomTres Shortcodes WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript into page content via the 'callout' shortcode's 'width' and 'align' attributes. The injected payload executes in the browsers of any subsequent visitor to the affected page, enabling session hijacking, credential theft, or malicious redirects scoped to the WordPress front-end. No public exploit has been identified at time of analysis, and the CVSS Scope:Changed rating reflects that the impact extends beyond the attacker's own session to affect other users.
Stored Cross-Site Scripting in the Easy Cart WordPress plugin (all versions up to and including 1.8) permits authenticated Contributor-level users to inject persistent JavaScript payloads via the 'add_to_cart' shortcode. The vulnerability originates in the ectp_add_to_cart() function at plugin.php lines 280-287, where shortcode attributes such as 'product_name', 'product_desc', 'itemid', 'product_qty', and 'price' are processed with sanitize_text_field()-a function that strips HTML tags but does not escape double-quote characters-before being embedded in double-quoted HTML attributes. This allows attribute context breakout and arbitrary event handler injection that executes against any visitor loading the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in the hiWeb Migration Simple WordPress plugin (all versions up to and including 2.0.0.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'new_domain' parameter rendered in template/force-re-migrate-confirm.php. Exploitation requires tricking a logged-in WordPress administrator into clicking a crafted URL, at which point the injected script executes in the administrator's browser session under the site's origin - a Changed scope per CVSS - enabling potential account takeover or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in source intelligence.
Cross-site request forgery in the Google Plus One Bottom WordPress plugin (all versions ≤ 0.0.2) enables unauthenticated remote attackers to overwrite plugin settings stored in the WordPress database by tricking an authenticated administrator into clicking a crafted link. The root cause is missing nonce validation in the googlePlusOneAdmin function, exposing the plusone-lang, plusone-callback, and plusone-url options to unauthorized modification. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the social-engineering dependency is the primary limiting factor rather than any technical barrier.
Stored Cross-Site Scripting in the WP Nano AD WordPress plugin (all versions through 1.31) allows authenticated administrators to inject persistent malicious scripts via the 'blogrole_link' parameter in add_links.php, with execution occurring in any victim's browser upon visiting the compromised page. Exploitation is restricted to WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly disabled - notably a configuration common in security-hardened deployments. No public exploit identified at time of analysis, though a public security writeup by BFS-Lab has been published on GitHub, increasing the likelihood of weaponized attempts against qualifying environments.
Reflected Cross-Site Scripting in the rognone WordPress plugin (versions ≤ 0.6.2) exposes visitors of affected sites to arbitrary JavaScript injection via the unsanitized 'mode' URL parameter in header.php. Unauthenticated remote attackers (PR:N per CVSS) can deliver a malicious link that, when clicked by a victim, executes attacker-controlled scripts in the victim's browser within the changed scope (S:C) of the WordPress application context. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the trivial attack complexity (AC:L) and zero authentication requirement lower the bar for opportunistic abuse.
Cross-Site Request Forgery in the BirdSeed WordPress plugin (all versions up to and including 2.2.0) enables unauthenticated remote attackers to overwrite the plugin's API token by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from birdseed_plugin_settings_page() accepting the birdseed_token GET parameter and persisting it via update_option() with no nonce verification, bypassing WordPress's standard CSRF protection entirely. No public exploit has been identified at time of analysis; CVSS rates this Medium (4.3) reflecting narrow integrity impact limited to token replacement.
Stored Cross-Site Scripting in the FPW Category Thumbnails WordPress plugin (all versions ≤1.9.5) allows authenticated attackers with Subscriber-level access to plant persistent JavaScript payloads via the unsanitized 'id' parameter of the 'fpw_fs_get_file' AJAX action. The injected script executes in an administrator's browser upon visiting the plugin's settings page, creating a privilege-escalation pathway from low-privileged subscriber to effective site administrator. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity and Changed Scope signal meaningful risk in open-registration WordPress environments.
Missing authorization controls in the JTL-Connector for WooCommerce WordPress plugin (all versions through 2.4.1) allow authenticated attackers holding only Subscriber-level access to invoke three unprotected server-side actions: modifying arbitrary plugin settings, downloading a ZIP archive of developer log files, and deleting those logs. The root cause is the complete absence of WordPress capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector handler and the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX handlers. No public exploit has been identified at time of analysis, and no patched version is confirmed in the available data.
Stored Cross-Site Scripting in the ZeM STL WordPress plugin (all versions through 1.0) allows authenticated contributors to plant persistent malicious scripts in page content via unsanitized [zemstl] shortcode attributes. Wordfence confirmed that the 'url', 'color', and 'bgcolor' shortcode parameters are directly interpolated into HTML attribute context within zemstl.php without passing through WordPress's esc_attr() or any equivalent escaping function, as evidenced by references to the vulnerable source lines (L74, L103, L104, L107). Any site visitor who loads a page containing the injected shortcode will silently execute the attacker's script, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including administrators. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Simple Custom Login Page WordPress plugin (versions ≤ 1.0.3) allows authenticated administrators to inject arbitrary CSS rules into wp-login.php, which is then rendered for every unauthenticated visitor to the login page. The changed scope (S:C in CVSS) is the critical risk amplifier: a single administrator-level compromise or malicious admin can silently overlay phishing UI elements on the WordPress login page, harvesting credentials from any user who subsequently visits. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Auto Image Attributes From Filename With Bulk Updater WordPress plugin (all versions through 4.9) allows authenticated attackers holding Author-level access or higher to persist arbitrary JavaScript payloads via unsanitized attachment metadata fields. The injected scripts execute in the browser of any user who subsequently accesses the affected page, with Changed scope (S:C) indicating the payload crosses the plugin's trust boundary into the broader WordPress session context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wpas_keys parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers to invoke privileged plugin operations without any credential requirement, resulting in partial integrity and availability impact on directory listings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, network-accessible exploitation requiring no user interaction, reported by Patchstack under the 'Authentication Bypass' tag. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority patch tier for any WordPress deployment running a public-facing GeoDirectory instance.
Stored XSS in the myCred WordPress plugin (versions through 3.0.4) enables authenticated low-privileged attackers to persistently inject malicious scripts into web pages served by the application. When a victim - such as an administrator - subsequently visits an affected page, the stored payload executes within their browser session in the context of the WordPress origin, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged users to download arbitrary files from the server filesystem. The vulnerability, reported by Patchstack as an arbitrary file download flaw, exposes full confidentiality impact (C:H) with no integrity or availability consequence, meaning attackers can exfiltrate sensitive server files - including wp-config.php, credentials, or private data - but cannot modify or destroy them. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Authorization bypass in Advanced Custom Fields (ACF®) plugin for WordPress versions up to and including 6.8.1 allows unauthenticated remote attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance. The attack requires no credentials, no user interaction, and low complexity - exploitable by anyone who can reach a page rendering a public-facing ACF front-end form. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the zero-barrier attack path makes content integrity on exposed WordPress sites a real concern.
Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function `update_site_editor_homepage`. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.
Payment bypass in the Contact Form 7 - PayPal & Stripe Add-on for WordPress (all versions up to and including 2.4.9) permits unauthenticated attackers to complete arbitrary pending orders without tendering the required payment amount. The IPN handler correctly authenticates PayPal callbacks via the `cmd=_notify-validate` round-trip, but then blindly trusts the attacker-controlled `invoice` field and passes it to `cf7pp_complete_payment()` without verifying that `mc_gross`, `mc_currency`, or `receiver_email` in the IPN match the stored order values - resulting in full order completion triggered by a minimal real payment. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the direct financial incentive and low attack complexity elevate real-world priority beyond what the medium CVSS score alone implies.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.
Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated remote attackers to inject persistent JavaScript via the user_id parameter, which executes in the browser of any user who visits an affected page. The flaw stems from insufficient input sanitization and output escaping in the plugin's settings handler, and no public exploit identified at time of analysis. With a CVSS 7.2 score reflecting Scope:Changed impact, the bug is notable because exploitation requires no authentication despite affecting an administrative-adjacent plugin component.
Stored Cross-Site Scripting in The Plus Addons for Elementor WordPress plugin (versions up to and including 6.4.15) allows authenticated contributor-level attackers to persistently inject malicious scripts via the carousel_direction parameter of the Carousel Anything widget. The root cause is an unquoted HTML attribute context in the render() function where esc_attr() is applied but insufficient - attribute injection is still possible by appending space-separated event handlers to the bare dir= attribute. Injected payloads persist in the database and execute in any visiting user's browser, including administrators, enabling session hijacking or privilege escalation; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Simple Divi Shortcode WordPress plugin (versions up to and including 1.2) allows authenticated attackers with contributor-level access to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'id' parameter of the [showmodule] shortcode. The injected payload executes in the browser of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or malicious redirects within the victim's authenticated session context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the StatCounter - Free Real Time Visitor Stats WordPress plugin (versions up to and including 2.1.1) allows authenticated users with Author-level access or higher to inject arbitrary JavaScript into post pages by setting a crafted WordPress profile nickname. The unescaped nickname is embedded directly into a JavaScript string context within a <script> block rendered on every post page via the wp_head hook, causing the payload to execute in the browser of any visitor - including unauthenticated users - who loads a post authored by the attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and broad exposure surface (every post page on affected sites) make this a practical risk wherever sites permit untrusted Author-level accounts.
Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows remote attackers to retrieve administrator-cached page content by supplying a forged session cookie. When the non-default 'Cache Logged-in Users' feature is active, the plugin resolves cached page files by parsing the username directly from the cookie value without verifying the WordPress HMAC signature, enabling any unauthenticated actor who knows or guesses a valid username to obtain that user's cached HTML output. Exposed data includes full content of private posts, Admin Bar markup, WordPress nonces, and other privileged interface elements. No public exploit has been identified and the vulnerability is not listed in CISA KEV; version 2.5.3 contains the fix.
Cross-Site Request Forgery in FastPicker (versions up to and including 1.0.2), a WooCommerce order management plugin for WordPress, allows unauthenticated remote attackers to modify the plugin's administrative settings by tricking a logged-in site administrator into clicking a crafted link. Specifically, the `settingsPage` function in `Admin.php` lacks proper nonce validation, enabling forged POST requests that can toggle the plugin's webhook integration and redirect FastPicker and KDZ API endpoint URLs to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-Site Request Forgery combined with stored XSS in the WP Emoticon Rating WordPress plugin (all versions ≤ 1.0.1) allows unauthenticated remote attackers to persistently inject malicious scripts into site settings by tricking a logged-in administrator into clicking a crafted link. The CVSS Scope:Changed rating reflects that the injected payload executes beyond the admin context, potentially affecting all site visitors. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X
Stored Cross-Site Scripting in the WP ApplicantStack Jobs Display WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Because the CVSS vector reflects Changed Scope (S:C), successful injection impacts the browsers of any user - including administrators - who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA KEV.
Stored Cross-Site Scripting in the WP GDPR Cookie Consent WordPress plugin (versions up to and including 1.0.0, by techjewel) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into pages served to all site visitors. The vulnerability chains three distinct weaknesses in the handleAjaxCalls() function: absent capability verification, missing nonce validation, and unsanitized gdprConfig values that are echoed verbatim by generateCSS() into a <style> block on wp_head. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber-level) and changed scope (S:C) make this a meaningful risk for multi-user WordPress sites.
Stored Cross-Site Scripting in the ePaperFlip Publisher WordPress plugin (all versions up to and including 1) permits authenticated Contributors to inject arbitrary JavaScript via the 'publicationid' attribute of the epaperflip_embed shortcode, which is written unsanitized directly into inline JavaScript on rendered pages. The CVSS Changed scope (S:C) reflects that the injected payload executes in the browser context of any visitor who loads the compromised page, crossing trust boundaries beyond the plugin itself. No public exploit code has been identified at time of analysis and this vulnerability is not currently listed in the CISA KEV catalog.
Cross-Site Request Forgery in the AJAX Report Comments WordPress plugin (≤2.0.4) allows unauthenticated attackers to modify plugin settings by tricking a logged-in administrator into triggering a forged request. The rc_options_page function in report-comments.php performs missing or incorrect nonce validation, enabling an attacker to overwrite notification email addresses, comment thresholds, link text, and message bodies without any privileges of their own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the notification email hijack vector makes this a meaningful integrity risk on affected sites.
Cross-Site Request Forgery combined with reflected XSS in the WpMobi WordPress plugin (all versions through 0.0.3) allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser session by forging a settings-save request. The handleSaveGeneralSettings function performs no nonce validation, permitting any remote party to submit crafted plugin settings on behalf of an authenticated admin. A particularly notable aspect is that the injected script in the app_name parameter fires even when server-side validation rejects the value, because the view layer re-renders the form with the unsanitized in-memory value rather than a sanitized fallback - meaning the XSS trigger does not depend on successful data persistence. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the RomanCart Ecommerce WordPress plugin (versions ≤2.0.8) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via the 'blclass' attribute - and other attributes - of the romancart_button shortcode. The injected payload executes in any visitor's browser upon page load, enabling session hijacking, credential theft, or administrative account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and changed scope (S:C) elevate real-world concern for multi-author WordPress deployments.
WP-Ultimate-Map plugin for WordPress (versions up to and including 1.1) is vulnerable to a chained CSRF-to-stored-XSS attack that allows unauthenticated network attackers to hijack plugin settings and inject persistent JavaScript into the WordPress admin panel. The missing nonce check on `process_init()` - hooked to `admin_init` - means any forged POST with a `save-setting` parameter will overwrite plugin options without any authentication or state validation. The injected `zoom-level` value is then stored unsanitized and reflected verbatim into an HTML attribute and inline JavaScript block on the settings page, completing the XSS chain. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the TinyMCE Shortcode Addon WordPress plugin (all versions ≤ 1.0.0) allows authenticated attackers with contributor-level access or higher to inject persistent JavaScript via the unsanitized 'btnrel' shortcode attribute. The injected script is stored server-side and executes in the browser of every subsequent visitor to the affected page, including administrators - enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated settings manipulation in Helpfulcrowd Product Reviews plugin for WordPress (versions up to and including 1.2.9) allows any remote attacker to overwrite arbitrary plugin configuration values in the WordPress database. The vulnerability stems from a PHP type juggling flaw in the token validation function combined with an openly accessible REST endpoint registered with `__return_true` as its permission callback. By submitting a JSON boolean `true` as the token value, an attacker bypasses the loose-comparison check (`!=`) in `helpfulcrowd_validate_token()` and gains full write access to the `helpfulcrowd_options` database option with no sanitization or allowlist enforcement. No public exploit or CISA KEV listing is identified at time of analysis.
Cross-Site Request Forgery in WP Meta Sort Posts WordPress plugin (all versions ≤ 0.9) allows unauthenticated remote attackers to modify plugin settings by tricking a logged-in administrator into clicking a crafted link, due to missing nonce validation in msp-options.php. The CVSS vector (PR:N, UI:R) confirms the attacker requires no authentication but must social-engineer an administrator, with impact limited to changing the msp_loop_file and msp_nav_location settings. No active exploitation confirmed - this CVE is not listed in CISA KEV, no public exploit code has been identified, and EPSS data was not provided in available intelligence.
Stored Cross-Site Scripting in the Global Body Mass Index Calculator WordPress plugin (versions up to and including 1.2) allows authenticated contributors to persistently inject arbitrary JavaScript into any page rendering the 'gbmicalc' shortcode. The vulnerability arises from PHP's @extract() call on unsanitized shortcode attributes followed by unescaped output into both an HTML style attribute context and an HTML body context inside GBMI_Calc_Widget::widget(), enabling attribute-breakout payloads. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the Wordfence-confirmed contributor-level requirement makes this a realistic risk for any multi-author WordPress installation.
Stored Cross-Site Scripting in the Extra Settings for RocketChat WordPress plugin (versions up to and including 0.1) allows authenticated attackers with contributor-level access to permanently inject arbitrary JavaScript via the 'title' attribute of the [rocketchat] shortcode. The injected script persists in the database and executes in the browser of any site visitor who loads an affected page, enabling session hijacking, credential theft, or further privilege escalation depending on victim role. No public exploit code identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Stored Cross-Site Scripting in WPZOOM's Recipe Card Blocks Lite WordPress plugin (all versions through 3.4.13) allows authenticated attackers with Author-level access or higher to inject persistent malicious scripts into published posts and recipe print views. The vulnerability is a sanitization bypass: the `WPZOOM_Helpers::deserialize_block_attributes` method re-decodes unicode-escaped character sequences back into raw HTML after WordPress's sanitization pipeline has already run, permitting crafted payloads in the recipe block's 'summary' and 'notes' attributes to survive sanitization and execute in victims' browsers. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Changed Scope (S:C) rating reflects cross-user impact, including potential administrator session hijacking.
WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin Stripe Payments 2.0.39 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin WP-Paginate 2.1.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the preset parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Time-based SQL injection in the Photo Gallery by 10Web WordPress plugin (all versions through 1.8.41) enables authenticated contributors to exfiltrate arbitrary data from the WordPress database via a stored shortcode payload that is subsequently triggered without authentication. The attack exploits the 'compact_album_order_by' parameter passed through the 'shortcode_bwg' AJAX handler, where insufficient escaping and absent query preparation allow appended SQL clauses to survive into execution. Critically, the stored malicious shortcode can be activated by the unauthenticated 'bwg_frontend_data' AJAX handler, collapsing the effective authentication barrier after the initial store step. No public exploit code or CISA KEV listing has been identified at time of analysis.
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in WP Maps (all versions through 4.9.4) allows authenticated attackers holding the wpgmp_manage_location capability - granted to administrators by default but delegable to lower-privileged roles - to inject persistent malicious scripts via the 'location_messages' parameter. The CVSS scope change (S:C) confirms the injected payload executes across victim browser sessions on any page rendering the affected shortcode, enabling session hijacking or unauthorized actions on behalf of site visitors. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the delegable capability expands the potential attacker pool beyond pure administrators.
Insecure Direct Object Reference in the Klamra Paycal for Aspaclaria WordPress plugin (all versions through 1.1.4) allows authenticated attackers with subscriber-level access to download invoices belonging to other customers by enumerating sequential WordPress post IDs via the unvalidated 'invoice_id' parameter. Exposed data includes full name, email address, phone number, order total, line items, and customer notes - constituting a significant billing PII breach for any e-commerce site running this plugin. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV, but the low attack complexity and sequential enumeration method make mass harvesting of customer data straightforward for any authenticated user.
Authorization bypass in the MapPress Maps for WordPress plugin exposes two distinct attack surfaces: an unauthenticated REST endpoint that leaks map data including POI titles, physical addresses, and coordinates for any map by ID enumeration, and an authenticated write surface where any Contributor-level user can modify, delete, clone, or trash maps they do not own. All versions through 2.96.6 are affected. No public exploit is confirmed exploited in the wild (not in CISA KEV), though Wordfence has published a public advisory and exploit information is available, and SSVC classifies the write path as automatable.
Authorization bypass in the Squirrly SEO WordPress plugin (all versions through 12.4.16) allows authenticated attackers with contributor-level access to invoke privileged Squirrly cloud API operations reserved for administrators, including revoking the site's Google Search Console and Google Analytics integrations via the `api/gsc/revoke` and `api/ga/revoke` endpoints. The flaw stems from the plugin's failure to verify the `sq_manage_settings` capability before processing these state-changing cloud API calls, meaning any contributor can silently destroy critical SEO and analytics data connections without administrator knowledge. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SQL Injection in OptinCraft (Drag & Drop Optins & Popup Builder for WordPress) versions up to and including 1.2.0 allows authenticated attackers with administrator-level access to extract sensitive data from the underlying WordPress database. The vulnerability exists in the 'order_by' parameter, which is passed without sufficient escaping or parameterized query preparation through the plugin's internal SQL compiler, enabling appending of arbitrary SQL to existing queries. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high confidentiality impact and network-accessible attack vector make it a meaningful data-disclosure risk in multi-administrator WordPress environments.
Unauthenticated webhook forgery in WPForms (wpforms-lite ≤1.10.0.1) enables payment fraud by allowing any remote attacker who knows a valid PayPal subscription_id to manipulate subscription payment records - including forcing a cancelled or suspended subscription back to active status - without any credentials or user interaction. The PayPal Commerce webhook endpoint accepts and acts on arbitrary JSON POST payloads, performing no HMAC-SHA256 origin verification, and trusts attacker-supplied resource data once the event_type field passes a whitelist check. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the zero-complexity attack path makes independent exploitation straightforward for anyone possessing a valid subscription_id.
Path traversal in the Quick Playground WordPress plugin (versions ≤ 1.3.4) exposes arbitrary server files to authenticated administrators. The flaw exists in client-qckply_data.php where the qckply_data() function forwards a user-supplied filename POST parameter directly into file_get_contents() without sanitization, enabling traversal sequences to escape the webroot and reach files such as wp-config.php or /etc/passwd. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, but exploitation would yield database credentials and other secrets with high confidentiality impact.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Stored Cross-Site Scripting in the Click to Chat - WA Widget WordPress plugin (holithemes, all versions through 4.38) allows authenticated Contributor-level users to inject persistent JavaScript payloads that execute in victim browsers when the rendered WhatsApp chat button is clicked. The root cause is a double-encoding bypass: esc_attr() sanitization produces HTML entities that are decoded back to literal characters by the browser's HTML parser before JavaScript evaluation inside an onclick event handler, completely defeating the intended escaping. No public exploit has been identified at time of analysis, but the detailed technical write-up from Wordfence combined with publicly browsable vulnerable source code significantly lowers the barrier to exploitation. Vendor-released patch version 4.39 is available.
PHP Object Injection in the LearnPress - Backup & Migration Tool WordPress plugin (versions ≤ 4.1.4, by ThimPress) allows authenticated administrators to supply maliciously crafted serialized data through the plugin's import functionality, triggering unsafe PHP deserialization. The vulnerability itself carries no direct impact in isolation - exploitation is contingent on a separate plugin or theme installing a usable POP (Property-Oriented Programming) chain on the same site, at which point an attacker can escalate to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 6.6 (High complexity, High privileges required) reflects the constrained real-world conditions.
Directory traversal in the LearnPress - Backup & Migration Tool plugin for WordPress (all versions through 4.1.4) allows authenticated administrators to read arbitrary files on the underlying server by supplying path traversal sequences via the 'import-user-file' parameter. Exploitation exposes highly sensitive server-side content - including wp-config.php database credentials, private keys, or system files - despite requiring high-privilege access. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. The CVSS score of 4.9 reflects the high privilege barrier (PR:H), but the C:H confidentiality impact makes successful exploitation consequential.
Reflected XSS in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin (all versions through 2.8.15) enables unauthenticated attackers to inject arbitrary JavaScript into victim browsers by crafting malicious URLs targeting pages where iframe mode is active. The vulnerability exists because URL parameters passed through the plugin's iframe rendering path (class.php lines 3460, 3462, 3470) are insufficiently sanitized before output. Exploitation is contingent on a non-default configuration (iframe mode enabled) and requires social engineering to make a user click a crafted link, but no public exploit code has been identified at time of analysis.
Directory traversal in the Smart Slider 3 WordPress plugin (all versions ≤ 3.5.1.36) exposes arbitrary server-side files to authenticated administrators via the replaceHTMLImage function in the plugin's slider export/backup subsystem. An attacker with administrator-level WordPress access can craft a request that traverses outside the intended directory and return the raw contents of sensitive files such as wp-config.php. No public exploit or CISA KEV listing exists at time of analysis, and the high privilege requirement (CVSS PR:H) substantially limits the realistic attack surface to insider threats, compromised admin accounts, or privilege-escalation chains.
Stored Cross-Site Scripting in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (all versions through 1.3.9.7) allows authenticated administrators to persist malicious JavaScript via the 'drag_n_drop_text' and 'drag_n_drop_browse_text' plugin settings fields, which subsequently execute in the browsers of any site visitor accessing a page containing an affected CF7 upload form. The CVSS Scope:Changed designation reflects this cross-user impact - a compromised or rogue admin can silently weaponize public-facing forms without further interaction. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS score of 4.4 reflects the high privilege and high complexity prerequisites that substantially limit opportunistic exploitation.
Stored Cross-Site Scripting in the Master Addons for Elementor WordPress plugin (versions up to and including 3.1.0) allows authenticated attackers with author-level access to inject persistent JavaScript into pages by exploiting a broken authorization boundary in the Custom JS Extension. The flaw arises because the unfiltered_html capability check is enforced only during UI rendering (Elementor control registration) and entirely absent from the save handler, permitting a crafted POST to admin-ajax.php?action=elementor_ajax to store arbitrary scripts that execute in every subsequent visitor's browser. No public exploit or CISA KEV listing has been identified at time of analysis, though the Wordfence disclosure and direct source-code references confirm the issue is well-documented.
Missing authorization in the Page-list WordPress plugin (all versions up to and including 6.2) allows authenticated contributors to read private and draft page content beyond their intended access scope. The [pagelist_ext] shortcode in the pagelist_unqprfx_ext_shortcode() function passes attacker-supplied post_status, post_type, and show_meta_key attributes directly into get_pages() and get_post_meta() with no capability check, and a critical amplification trigger - when no child pages exist, the query falls back to child_of => 0, broadening scope to every matching page on the entire site. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and straightforward exploitation path via shortcode injection make this a meaningful insider-threat risk on sites with sensitive unpublished content.
Authorization bypass in the Alba Board WordPress plugin (all versions through 2.1.3) exposes private project card data to unauthorized access. Despite the CVSS vector assigning PR:L (low privileges required), the vulnerability description explicitly reveals a more severe exploitation path: the AJAX handler is registered under the wp_ajax_nopriv_ hook, and the required nonce is broadcast to all site visitors via wp_localize_script on any page rendering the [alba_board] shortcode - enabling fully unauthenticated access to private alba_card records including titles, descriptions, assignees, due dates, tags, and comments. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the vulnerable code path is publicly browsable in the WordPress plugin repository.
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Soliloquy Lite 2.5.6 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sensitive data exposure in the WP eMember WordPress plugin (Tips and Tricks HQ) through version 10.2.2 allows unauthenticated remote attackers to retrieve embedded sensitive system information via a network request. The vulnerability is classified under CWE-497, meaning internally sensitive data is reachable from an unauthorized control sphere - in this case, the open internet without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation probability from EPSS data was not provided, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially reachable from any network source.
Privilege escalation in the Mojoomla School Management WordPress plugin (versions up to and including 93.2.0) allows authenticated low-privileged users to elevate their permissions to higher-privileged roles such as administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 3.1 score of 8.8 with no public exploit identified at time of analysis. Any WordPress site running the plugin in its default state is vulnerable until an upstream patch is released.
SQL injection in Mojoomla School Management plugin for WordPress (versions up to and including 93.2.0) allows high-privileged authenticated attackers to inject crafted SQL through unsanitized input, leading to confidentiality compromise of the underlying database and limited availability impact. The scope-changed CVSS 7.6 rating reflects that exploitation can affect resources beyond the vulnerable component, such as the shared WordPress database hosting other plugins or sites. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting in Fox-themes Prague (WordPress theme/plugin family) through version 2.2.8 lets a remote attacker inject script that executes in a victim's browser when the victim clicks an attacker-crafted link. The flaw was disclosed via Patchstack and carries a CVSS 7.1 (scope-changed) rating; no public exploit identified at time of analysis and the issue is not on CISA KEV.
Missing authorization controls in the Elementor Website Builder WordPress plugin through version 4.1.0 allow low-privilege authenticated users to exploit incorrectly configured access control levels, resulting in limited unauthorized read and write access to restricted plugin functionality. The flaw (CWE-862) means the plugin fails to validate whether the authenticated requestor holds sufficient WordPress capabilities before granting access to protected operations. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though the low attack complexity makes this straightforward to exploit once a valid account is obtained.
Stored XSS in the Progress Planner WordPress plugin (versions through 1.9.0) enables a high-privileged attacker to inject persistent malicious scripts into web pages served to other users. Because the scope is marked Changed (S:C), the injected payload executes in the context of lower-privileged site visitors, not just the attacker's session, crossing the admin-to-user security boundary. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Crew HRM WordPress plugin (versions through 1.2.2) permits authenticated low-privileged users to invoke plugin functionality beyond their intended authorization level, resulting in limited unauthorized data modification and availability impact. The flaw, rooted in CWE-862 Missing Authorization, means the plugin fails to validate whether the requesting user holds the required WordPress capability before executing sensitive operations. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Local file inclusion in the UnboundStudio Accordion FAQ WordPress plugin (versions up to and including 2.2.1) allows authenticated remote attackers to include and execute arbitrary PHP files from the server filesystem via improperly controlled include/require statements. The flaw, reported by Patchstack and tagged as LFI/Information Disclosure, can lead to full compromise of the WordPress instance through disclosure of sensitive configuration data (e.g., wp-config.php) and potential code execution if attacker-controlled files are reachable. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in the ThimPress Thim Core WordPress plugin (all versions through 2.3.3) allows authenticated low-privileged users to perform actions exceeding their intended permission level due to improperly enforced access control checks. The flaw, classified as CWE-862 (Missing Authorization), results in unauthorized integrity-impacting operations without requiring administrative credentials, as confirmed by the CVSS vector (PR:L/I:L). No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Privilege-bound arbitrary code execution in ThimPress Thim Core (WordPress plugin) versions through 2.3.3 allows authenticated low-privilege users to bypass authorization checks and execute arbitrary code on affected sites, per Patchstack's advisory tagging this as an authentication bypass leading to RCE. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity over the network. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Themeisle Masteriyo LMS PRO (WordPress plugin) up to and including version 2.20.0 allows remote unauthenticated attackers to gain elevated privileges through incorrect privilege assignment (CWE-266). The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis, but the Patchstack advisory confirms the flaw class and affected version range.
Missing Authorization in the Printeers Print & Ship WordPress plugin (versions through 1.17.0) allows authenticated low-privileged users to perform actions that should be restricted to higher-privileged roles, resulting in high-integrity impact against affected WordPress sites. The flaw is classified under CWE-862 and reported by Patchstack as an incorrectly configured access control security level, meaning the plugin fails to enforce proper capability checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the moderate-priority tier for WordPress site operators running the affected plugin.
Reflected cross-site scripting in the UnboundStudio Accordion FAQ WordPress plugin (versions through 2.2.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser session by luring them to click a crafted link. The CVSS 7.1 score reflects scope change (S:C), meaning script execution can affect resources beyond the vulnerable component, such as the WordPress admin context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Tiled Gallery Carousel Without JetPack WordPress plugin (versions up to and including 3.1) allows authenticated attackers with contributor-level access to inject persistent malicious JavaScript via the 'data-image-title' parameter. The injected script executes in victims' browsers each time an affected gallery page is visited, enabling session theft, credential harvesting, or malicious redirects against site visitors and administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the low privilege barrier (contributor access) broadens the potential attacker pool on sites with open registration.
Cross-Site Request Forgery in the Laiser Tag WordPress plugin (versions up to and including 1.2.5) allows unauthenticated remote attackers to overwrite critical plugin settings - including API keys, tag blacklists, relevance thresholds, batch sizes, and tagging toggles - by tricking a logged-in site administrator into clicking a crafted link. The root cause is missing or incorrect nonce validation on the addOptionsPageFields function, as identified by Wordfence and corroborated by source references pointing to Tagging.php and adminOptionPage.php in the plugin's trunk. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world exploitation opportunity relatively constrained by the required administrator interaction.
Cross-Site Request Forgery in the Remove Meta Boxes Per User Role WordPress plugin (all versions ≤1.01) enables unauthenticated remote attackers to modify or reset per-role admin dashboard meta box visibility settings by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation on the plugin's settings page, which is the standard WordPress anti-CSRF mechanism. No public exploit has been identified and the issue is not listed in CISA KEV; real-world impact is limited to low-integrity administrative configuration tampering.
Reflected Cross-Site Scripting in the rognone plugin for WordPress (versions up to and including 0.6.2) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link containing a malicious 'a' parameter. The vulnerability originates in header.php at line 74, where user-supplied input is reflected into page output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Cross-Site Request Forgery in the Remove NoFollow Commenter URL WordPress plugin (all versions ≤ 1.0) allows unauthenticated remote attackers to modify the plugin's comment-display settings by tricking a logged-in site administrator into clicking a crafted link. The vulnerability stems from absent or incorrect nonce validation in the `gmz_comment_settings_save` function, meaning the plugin accepts state-changing POST requests without verifying they originated from a legitimate admin session. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the required user interaction as a meaningful limiting factor.
Stored Cross-Site Scripting in the Word Replacer WordPress plugin (versions up to and including 0.4) allows authenticated attackers with Administrator-level access to persist arbitrary JavaScript payloads via the 'replacement' parameter, which subsequently execute in the browsers of any user visiting an affected page. Reported by Wordfence, the root cause is insufficient input sanitization and output escaping in word-replacer.php at multiple code locations (lines 191, 230, 339, 343). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Tectite Forms WordPress plugin (all versions through 1.3) allows unauthenticated remote attackers to modify plugin settings by inducing an authenticated administrator to click a crafted link. The vulnerable surface is the admin_init function, which lacks proper nonce validation (CWE-352), permitting forged requests to alter options such as tectite_forms_button. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the DeMomentSomTres Shortcodes WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript into page content via the 'callout' shortcode's 'width' and 'align' attributes. The injected payload executes in the browsers of any subsequent visitor to the affected page, enabling session hijacking, credential theft, or malicious redirects scoped to the WordPress front-end. No public exploit has been identified at time of analysis, and the CVSS Scope:Changed rating reflects that the impact extends beyond the attacker's own session to affect other users.
Stored Cross-Site Scripting in the Easy Cart WordPress plugin (all versions up to and including 1.8) permits authenticated Contributor-level users to inject persistent JavaScript payloads via the 'add_to_cart' shortcode. The vulnerability originates in the ectp_add_to_cart() function at plugin.php lines 280-287, where shortcode attributes such as 'product_name', 'product_desc', 'itemid', 'product_qty', and 'price' are processed with sanitize_text_field()-a function that strips HTML tags but does not escape double-quote characters-before being embedded in double-quoted HTML attributes. This allows attribute context breakout and arbitrary event handler injection that executes against any visitor loading the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in the hiWeb Migration Simple WordPress plugin (all versions up to and including 2.0.0.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'new_domain' parameter rendered in template/force-re-migrate-confirm.php. Exploitation requires tricking a logged-in WordPress administrator into clicking a crafted URL, at which point the injected script executes in the administrator's browser session under the site's origin - a Changed scope per CVSS - enabling potential account takeover or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in source intelligence.
Cross-site request forgery in the Google Plus One Bottom WordPress plugin (all versions ≤ 0.0.2) enables unauthenticated remote attackers to overwrite plugin settings stored in the WordPress database by tricking an authenticated administrator into clicking a crafted link. The root cause is missing nonce validation in the googlePlusOneAdmin function, exposing the plusone-lang, plusone-callback, and plusone-url options to unauthorized modification. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the social-engineering dependency is the primary limiting factor rather than any technical barrier.
Stored Cross-Site Scripting in the WP Nano AD WordPress plugin (all versions through 1.31) allows authenticated administrators to inject persistent malicious scripts via the 'blogrole_link' parameter in add_links.php, with execution occurring in any victim's browser upon visiting the compromised page. Exploitation is restricted to WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly disabled - notably a configuration common in security-hardened deployments. No public exploit identified at time of analysis, though a public security writeup by BFS-Lab has been published on GitHub, increasing the likelihood of weaponized attempts against qualifying environments.
Reflected Cross-Site Scripting in the rognone WordPress plugin (versions ≤ 0.6.2) exposes visitors of affected sites to arbitrary JavaScript injection via the unsanitized 'mode' URL parameter in header.php. Unauthenticated remote attackers (PR:N per CVSS) can deliver a malicious link that, when clicked by a victim, executes attacker-controlled scripts in the victim's browser within the changed scope (S:C) of the WordPress application context. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the trivial attack complexity (AC:L) and zero authentication requirement lower the bar for opportunistic abuse.
Cross-Site Request Forgery in the BirdSeed WordPress plugin (all versions up to and including 2.2.0) enables unauthenticated remote attackers to overwrite the plugin's API token by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from birdseed_plugin_settings_page() accepting the birdseed_token GET parameter and persisting it via update_option() with no nonce verification, bypassing WordPress's standard CSRF protection entirely. No public exploit has been identified at time of analysis; CVSS rates this Medium (4.3) reflecting narrow integrity impact limited to token replacement.
Stored Cross-Site Scripting in the FPW Category Thumbnails WordPress plugin (all versions ≤1.9.5) allows authenticated attackers with Subscriber-level access to plant persistent JavaScript payloads via the unsanitized 'id' parameter of the 'fpw_fs_get_file' AJAX action. The injected script executes in an administrator's browser upon visiting the plugin's settings page, creating a privilege-escalation pathway from low-privileged subscriber to effective site administrator. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity and Changed Scope signal meaningful risk in open-registration WordPress environments.
Missing authorization controls in the JTL-Connector for WooCommerce WordPress plugin (all versions through 2.4.1) allow authenticated attackers holding only Subscriber-level access to invoke three unprotected server-side actions: modifying arbitrary plugin settings, downloading a ZIP archive of developer log files, and deleting those logs. The root cause is the complete absence of WordPress capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector handler and the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX handlers. No public exploit has been identified at time of analysis, and no patched version is confirmed in the available data.
Stored Cross-Site Scripting in the ZeM STL WordPress plugin (all versions through 1.0) allows authenticated contributors to plant persistent malicious scripts in page content via unsanitized [zemstl] shortcode attributes. Wordfence confirmed that the 'url', 'color', and 'bgcolor' shortcode parameters are directly interpolated into HTML attribute context within zemstl.php without passing through WordPress's esc_attr() or any equivalent escaping function, as evidenced by references to the vulnerable source lines (L74, L103, L104, L107). Any site visitor who loads a page containing the injected shortcode will silently execute the attacker's script, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including administrators. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Simple Custom Login Page WordPress plugin (versions ≤ 1.0.3) allows authenticated administrators to inject arbitrary CSS rules into wp-login.php, which is then rendered for every unauthenticated visitor to the login page. The changed scope (S:C in CVSS) is the critical risk amplifier: a single administrator-level compromise or malicious admin can silently overlay phishing UI elements on the WordPress login page, harvesting credentials from any user who subsequently visits. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Auto Image Attributes From Filename With Bulk Updater WordPress plugin (all versions through 4.9) allows authenticated attackers holding Author-level access or higher to persist arbitrary JavaScript payloads via unsanitized attachment metadata fields. The injected scripts execute in the browser of any user who subsequently accesses the affected page, with Changed scope (S:C) indicating the payload crosses the plugin's trust boundary into the broader WordPress session context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wpas_keys parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers to invoke privileged plugin operations without any credential requirement, resulting in partial integrity and availability impact on directory listings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, network-accessible exploitation requiring no user interaction, reported by Patchstack under the 'Authentication Bypass' tag. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority patch tier for any WordPress deployment running a public-facing GeoDirectory instance.
Stored XSS in the myCred WordPress plugin (versions through 3.0.4) enables authenticated low-privileged attackers to persistently inject malicious scripts into web pages served by the application. When a victim - such as an administrator - subsequently visits an affected page, the stored payload executes within their browser session in the context of the WordPress origin, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in the Classified Listing WordPress plugin (versions through 5.3.8) enables authenticated low-privileged users to download arbitrary files from the server filesystem. The vulnerability, reported by Patchstack as an arbitrary file download flaw, exposes full confidentiality impact (C:H) with no integrity or availability consequence, meaning attackers can exfiltrate sensitive server files - including wp-config.php, credentials, or private data - but cannot modify or destroy them. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Authorization bypass in Advanced Custom Fields (ACF®) plugin for WordPress versions up to and including 6.8.1 allows unauthenticated remote attackers to overwrite the post_title and post_content of any post bound to a publicly accessible acf_form() instance. The attack requires no credentials, no user interaction, and low complexity - exploitable by anyone who can reach a page rendering a public-facing ACF front-end form. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the zero-barrier attack path makes content integrity on exposed WordPress sites a real concern.
Unauthenticated modification of SEO metadata settings is possible in the Rank Math SEO WordPress plugin through version 1.0.271, stemming from a missing authorization check on the REST API function `update_site_editor_homepage`. Remote, unauthenticated attackers can overwrite homepage title, meta descriptions, breadcrumb labels, and social media metadata, enabling SEO poisoning campaigns and injection of malicious content into breadcrumb components rendered sitewide. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity and requires no authentication.
Payment bypass in the Contact Form 7 - PayPal & Stripe Add-on for WordPress (all versions up to and including 2.4.9) permits unauthenticated attackers to complete arbitrary pending orders without tendering the required payment amount. The IPN handler correctly authenticates PayPal callbacks via the `cmd=_notify-validate` round-trip, but then blindly trusts the attacker-controlled `invoice` field and passes it to `cf7pp_complete_payment()` without verifying that `mc_gross`, `mc_currency`, or `receiver_email` in the IPN match the stored order values - resulting in full order completion triggered by a minimal real payment. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the direct financial incentive and low attack complexity elevate real-world priority beyond what the medium CVSS score alone implies.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.
Stored cross-site scripting in the Link Whisper Free WordPress plugin (versions through 0.9.0) allows unauthenticated remote attackers to inject persistent JavaScript via the user_id parameter, which executes in the browser of any user who visits an affected page. The flaw stems from insufficient input sanitization and output escaping in the plugin's settings handler, and no public exploit identified at time of analysis. With a CVSS 7.2 score reflecting Scope:Changed impact, the bug is notable because exploitation requires no authentication despite affecting an administrative-adjacent plugin component.
Stored Cross-Site Scripting in The Plus Addons for Elementor WordPress plugin (versions up to and including 6.4.15) allows authenticated contributor-level attackers to persistently inject malicious scripts via the carousel_direction parameter of the Carousel Anything widget. The root cause is an unquoted HTML attribute context in the render() function where esc_attr() is applied but insufficient - attribute injection is still possible by appending space-separated event handlers to the bare dir= attribute. Injected payloads persist in the database and execute in any visiting user's browser, including administrators, enabling session hijacking or privilege escalation; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Simple Divi Shortcode WordPress plugin (versions up to and including 1.2) allows authenticated attackers with contributor-level access to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'id' parameter of the [showmodule] shortcode. The injected payload executes in the browser of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or malicious redirects within the victim's authenticated session context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the StatCounter - Free Real Time Visitor Stats WordPress plugin (versions up to and including 2.1.1) allows authenticated users with Author-level access or higher to inject arbitrary JavaScript into post pages by setting a crafted WordPress profile nickname. The unescaped nickname is embedded directly into a JavaScript string context within a <script> block rendered on every post page via the wp_head hook, causing the payload to execute in the browser of any visitor - including unauthenticated users - who loads a post authored by the attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and broad exposure surface (every post page on affected sites) make this a practical risk wherever sites permit untrusted Author-level accounts.
Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows remote attackers to retrieve administrator-cached page content by supplying a forged session cookie. When the non-default 'Cache Logged-in Users' feature is active, the plugin resolves cached page files by parsing the username directly from the cookie value without verifying the WordPress HMAC signature, enabling any unauthenticated actor who knows or guesses a valid username to obtain that user's cached HTML output. Exposed data includes full content of private posts, Admin Bar markup, WordPress nonces, and other privileged interface elements. No public exploit has been identified and the vulnerability is not listed in CISA KEV; version 2.5.3 contains the fix.