Wordpress Plugin
Monthly
Missing authorization check in Watu Quiz plugin for WordPress up to version 3.4.5 permits authenticated low-privilege users to perform unauthorized modifications, such as altering quiz content or settings. The flaw stems from incorrectly configured access control security levels, allowing attackers with subscriber or contributor roles to bypass intended restrictions. No active exploitation has been reported, and EPSS indicates low likelihood of widespread attacks.
Broken access control in Cooked WordPress plugin versions ≤1.11.3 allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. The vulnerability stems from missing authorization validation (CWE-862), enabling privilege escalation and unauthorized data manipulation. With CVSS 8.8 and EPSS probability of 0.06% (18th percentile), real-world exploitation risk is moderate; no public exploit identified at time of analysis.
Missing authorization in WP Document Revisions plugin ≤3.7.2 allows authenticated high‑privilege users to bypass access controls and modify document data without proper authorization. The vulnerability carries Low severity (CVSS 2.7) due to the high permission level required and limited integrity impact. No active exploitation or public exploit is currently known.
Cross-Site Request Forgery (CSRF) in the Vimeotheque plugin for WordPress (version 2.3.5.2 and earlier) allows unauthenticated attackers to trick authenticated users into performing state-changing actions, resulting in low integrity impact. The flaw carries a CVSS v3.1 score of 4.3 (Medium) but has an EPSS exploitation probability of only 0.02%, indicating very low real-world risk. No active exploitation or public exploit code has been identified at the time of analysis.
Cross-Site Request Forgery in the Fast User Switching WordPress plugin (versions ≤1.4.10) allows tricking an administrator into performing unintended user-switching actions. The flaw poses a medium risk (CVSS 4.3) but requires user interaction and is not currently known to be actively exploited nor publicly weaponized.
Missing authorization in the Funnelforms Free plugin for WordPress (versions up to 3.8) allows unauthenticated attackers to modify plugin data due to incorrectly configured access control. The vulnerability (CWE-862) has a CVSS 5.3 rating with low integrity impact only; no confidentiality or availability is affected. At the time of analysis, there is no evidence of active exploitation and the EPSS score is low (0.06%), indicating limited urgency.
Missing authorization in YITH Slider for page builders (WordPress plugin) allows authenticated low-privileged attackers to view and modify slider content without proper permission checks. Patches are implied in versions beyond 1.0.11. No active exploitation or public exploit code is currently known.
Cross-site request forgery in Advanced Classifieds & Directory Pro for WordPress up to version 3.2.9 allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings, by tricking an authenticated administrator into clicking a crafted link. No public exploit or active exploitation is known, and EPSS gives a 0.02% probability of exploitation, indicating very low real-world risk.
Unauthorized modification of data in the WordPress FV Simpler SEO plugin versions up to and including 1.9.6 allows unauthenticated attackers to change plugin settings due to missing authorization checks. This vulnerability, reported by Patchstack, has a low predicted exploitation probability (EPSS 0.04%) and no public exploit or active exploitation identified at time of analysis.
Unauthorized data modification via missing authorization in the Addonify Quick View WordPress plugin (<= 2.0.4) allows remote, unauthenticated attackers to alter plugin settings or content due to missing capability checks on an AJAX endpoint. No active exploitation or public exploit code is known, and EPSS assigns a very low exploitation probability (0.04%).
Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.
Cross-site scripting in WPBakery Visual Composer WHMCS Elements plugin for WordPress allows authenticated attackers with high privileges to inject malicious scripts via DOM manipulation. This XSS can lead to limited data disclosure or actions within the victim's session but requires user interaction. No public exploit or active exploitation reported.
Cross-site request forgery in Simple Keyword to Link WordPress plugin version 1.5 and below allows unauthenticated attackers to trick authenticated administrators into modifying keyword-to-link associations through crafted requests. No active exploitation or public exploit code has been identified, and the low EPSS score suggests a low probability of widespread attacks.
Unauthenticated missing authorization flaw in the BBP Core WordPress plugin (versions ≤1.4.1) allows attackers to modify certain data with low integrity impact. No confidentiality is exposed. The flaw, assigned CWE-862, has a CVSS base score of 5.3 (Medium) but is not actively exploited.
Broken access control in SALESmanago WordPress plugin allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. Affects versions up to 3.9.0. The vulnerability enables complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Broken access control in WP Time Slots Booking Form plugin (≤1.2.39) allows authenticated attackers with low-level privileges to escalate permissions and execute unauthorized administrative actions. The vulnerability stems from missing authorization checks (CWE-862), enabling privilege escalation to access, modify, or delete sensitive booking data and configuration settings. While CVSS scores 8.8 (High), real-world risk appears moderate with EPSS at 0.06% (18th percentile) and no public exploit identified at time of analysis.
Missing authorization in Claspo WordPress plugin through version 1.0.7 allows unauthenticated remote attackers to modify data via incorrectly configured access controls. With CVSS 7.5 (High integrity impact) but only 0.04% EPSS probability, this represents elevated exposure in vulnerable installations despite low observed exploitation likelihood. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized actions without credentials.
Cross-Site Request Forgery in WordPress plugin My Auctions Allegro (versions ≤3.6.33) allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through social engineering. CVSS 8.8 severity stems from potential high confidentiality, integrity, and availability impact if victims are tricked into clicking malicious links while authenticated. EPSS score of 0.02% (6th percentile) indicates very low probability of exploitation in the wild. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring user interaction.
Stored cross-site scripting (XSS) in WordPress plugin My auctions allegro (versions up to 3.6.35) allows authenticated users to inject malicious scripts that execute in other users' browsers when viewing auction content. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected WordPress installations, though with limited scope within the plugin context. No public exploit code or active exploitation has been identified; real-world risk is moderate given the requirement for authenticated access and user interaction.
Missing authorization in Twitch Player WordPress plugin (ttv-easy-embed-player) versions up to 2.1.3 allows remote unauthenticated attackers to trigger a denial-of-service condition via exploitation of incorrectly configured access control security levels. This CWE-862 vulnerability impacts only availability and has no confidentiality or integrity impact. No active exploitation or public exploit code is confirmed at this time; EPSS indicates a 0.06% probability of exploitation in the next 30 days.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Unauthorized modification possible in the Sunshine Photo Cart WordPress plugin up to version 3.5.7.1 due to missing authorization checks. Authenticated low-privileged users can exploit misconfigured access controls to alter data they should not have access to. No active exploitation or public exploit is known, and EPSS indicates a 0.04% probability of exploitation in the next 30 days.
Stored cross-site scripting in HasThemes WC Builder WordPress plugin up to version 1.2.0 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages created with the plugin. When victims view the crafted page, the script executes in their browser, leading to potential data theft or session hijacking.
Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).
Unauthorized setting modification in the WP Email Capture WordPress plugin through version 3.12.5 allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as altering email capture settings. The vulnerability requires user interaction and has very low exploitation probability (EPSS 0.02%); no active exploitation or public exploit code is known.
Stored cross-site scripting in the Academy LMS WordPress plugin up to version 3.4.0 allows authenticated attackers with low privileges to inject JavaScript into web pages viewed by other users. No evidence of active exploitation or public exploit code exists; EPSS indicates a very low exploitation probability (0.04%).
Stored Cross-Site Scripting in the pixelgrade Category Icon WordPress plugin through version 1.0.2 enables authenticated administrators to inject malicious scripts that execute in other users' browsers, leading to low-impact compromise of confidentiality and integrity. No active exploitation or public proof-of-concept code is currently known, and EPSS indicates a low exploitation probability (0.04%).
Authenticated data modification in the Spiffy Calendar WordPress plugin allows low-privilege attackers to edit calendar events without proper authorization. The vulnerability affects all plugin versions up to and including 5.0.7. No active exploitation or public exploit code has been observed, and EPSS indicates a negligible chance of widespread exploitation.
Information disclosure in WpStream plugin for WordPress up to version 4.9.5 allows authenticated low-privileged users to read sensitive configuration data due to a missing authorization check (CWE-862). The vulnerability requires a subscriber-level account and exposes limited confidentiality information without affecting integrity or availability. No active exploitation or public exploit code has been identified at time of analysis.
Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).
Missing authorization in the Tablesome WordPress plugin allows authenticated low-privilege users to modify or disrupt plugin data. Affected versions up to 1.1.35.1; no active exploitation or public exploit identified at this time.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Stored cross-site scripting in the Bold Timeline Lite plugin for WordPress allows authenticated attackers to inject arbitrary web scripts. Versions up to and including 1.2.7 are affected, enabling an attacker with low privileges to store a payload that executes when a victim views an infected timeline page. The CVSS 6.5 rating reflects medium severity, but the very low EPSS exploitation probability (0.04%) suggests minimal real-world threat; no public exploit or active exploitation is known.
Stored cross-site scripting in Real 3D FlipBook plugin up to version 4.11.4 allows authenticated users with low privileges to inject malicious scripts that execute in victim browsers. This can lead to session hijacking or
Missing authorization in Gutenverse Form plugin for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, resulting in a high availability impact. Versions up to and including 2.3.1 are affected, and no active exploitation has been reported.
An open redirect vulnerability in Jeff Starr's User Submitted Posts WordPress plugin allows attackers to craft malicious URLs that redirect victims to untrusted websites for phishing. All plugin versions up to and including 20251121 are affected, requiring user interaction to trigger. Public exploit code is available
Missing authorization in the Brave Popup Builder WordPress plugin (version <= 0.8.3) allows unauthenticated attackers to access functionality not properly restricted by access controls. Exploitation could lead to disclosure of sensitive information with no user interaction required. EPSS suggests a very low exploitation probability (0.04%) and no public exploit code has been identified.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Unauthenticated information disclosure in the H5P WordPress plugin up to version 1.16.1 allows remote attackers to access sensitive data due to missing authorization checks. No authentication is required, but only low confidentiality impact is expected. No public exploit has been identified, and exploitation is not known to be active.
Server-side request forgery (SSRF) in the BdThemes Prime Slider addon for Elementor (up to version 4.0.10)
Stored cross-site scripting in Astra Widgets WordPress plugin up to version 1.2.16 allows authenticated attackers with admin access to inject malicious scripts that execute when other users view pages containing affected widgets. No public exploit or active exploitation has been reported, and EPSS probability is low (0.04%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
PHP object injection in Icegram Express Pro (WordPress email marketing plugin) through version 5.9.13 enables unauthenticated remote attackers to execute arbitrary code via unsafe deserialization of user-controlled data. With CVSS 9.8 (critical severity) and network-accessible attack vector requiring no authentication or user interaction, this represents a severe pre-authentication RCE risk. EPSS score of 0.06% (19th percentile) suggests low immediate exploitation probability, and no public exploit or CISA KEV listing identified at time of analysis, though Patchstack disclosure increases attacker awareness.
DOM-based Cross-Site Scripting in the Greenhouse Job Board WordPress plugin versions up to 2.7.3 allows authenticated administrators to inject arbitrary scripts. A victim admin browsing a page where the payload is rendered could have their browser execute the malicious code, leading to session hijacking or data theft. At time of analysis, no active exploitation or public exploit is known.
DOM-based cross-site scripting (XSS) in the GARD AdSense plugin for WordPress versions ≤2.23 allows authenticated administrators to inject malicious scripts that execute in the browser of a victim who interacts with a crafted link. Exploitation requires high-privilege user access and victim user interaction, and no public exploit or active attacks are known (EPSS 0.04%).
Stored cross-site scripting in the WordPress Gift Hunt plugin up to version 2.0.2 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when other users view the affected plugin pages. This can lead to session hijacking, credential theft, or unauthorized actions within the site. EPSS indicates very low exploitation probability (0.04%), no active exploitation is known, and no public proof-of-concept has been identified.
Stored cross-site scripting in WordPress WH Tweaks plugin up to version 1.0.2 allows authenticated administrators to inject web scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires high privileges (admin) and user interaction (victim must view the poisoned page), with no public exploit or active exploitation confirmed. Its CVSS base score of 5.9 indicates a moderate risk primarily for sites where untrusted individuals may hold administrator roles.
Stored cross-site scripting in the Basticom Framework WordPress plugin up to version 1.5.2 enables authenticated administrators to inject arbitrary web scripts. These scripts execute in the browsers of other users who view the affected page, potentially leading to session hijacking, phishing, or defacement. No active exploitation or public exploit code has been identified at time of analysis, and the EPSS likelihood is very low (0.04%).
Stored cross-site scripting in the WordPress Review Disclaimer plugin versions up to 2.0.3 allows authenticated high-privilege attackers (e.g., admin) to inject arbitrary web scripts that execute in the browsers of other users. While no active exploitation is confirmed and the EPSS likelihood is very low (0.04%), a successful attack could lead to session theft or site defacement when a victim views the injected content.
Stored cross-site scripting in the TouchOfTech Draft Notify WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users’ browsers when they view affected pages. Versions up to and including 1.5 are vulnerable. The flaw is not actively exploited, and no public exploit code has been identified.
Cross-Site Request Forgery in the Trade Runner WordPress plugin (versions ≤ 3.14) allows a remote attacker to trick a logged-in administrator into submitting a forged request, resulting in unauthorized low-impact data modification. The vulnerability is not listed in CISA KEV and has no known public exploit, with EPSS score indicating very low exploitation likelihood.
Server-Side Request Forgery (SSRF) in 6Storage Rentals WordPress plugin versions ≤2.20.2 allows unauthenticated remote attackers to send crafted requests from the vulnerable server to arbitrary internal or external systems. With CVSS 9.1 (critical) due to network-accessible attack vector requiring no authentication or user interaction, attackers can achieve high confidentiality and integrity impact by potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive data. EPSS score of 0.04% (14th percentile) indicates relatively low observed exploitation probability despite the critical severity rating. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Cross-site scripting (XSS) vulnerability in CodexThemes TheGem Theme Elements (for Elementor) plugin through version 5.10.5.1 allows improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially compromising WordPress site visitors and administrators. No active exploitation has been confirmed at time of analysis, though the low EPSS score (0.04%) suggests limited real-world exploitation likelihood despite the vulnerability's presence in a widely-used Elementor theme plugin.
Chakra test WordPress plugin version 1.0.1 and earlier fails to properly enforce access control restrictions, allowing unauthenticated or lower-privileged users to bypass authentication mechanisms and access restricted functionality. The vulnerability stems from incorrectly configured security levels that do not validate user permissions before executing sensitive operations, and is tracked with an exceptionally low EPSS score (0.04%) despite the missing authorization flaw, suggesting limited real-world exploitation despite the theoretical risk.
Missing authorization controls in VillaTheme HAPPY helpdesk plugin versions up to 1.0.9 allow unauthenticated attackers to bypass access restrictions and interact with support ticket functionality without proper permission verification. This authentication bypass vulnerability affects WordPress installations using the vulnerable plugin and could permit unauthorized access to sensitive support tickets and helpdesk operations. The issue has been reported by Patchstack security researchers with a low EPSS exploitation probability (0.04%) despite the authorization flaw.
VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.
Blind SQL injection in WPBulky WordPress plugin through version 1.1.13 allows high-privileged authenticated attackers to extract database contents and potentially cause limited service disruption. The vulnerability exists in the bulk edit functionality where user-supplied input is improperly sanitized before inclusion in SQL queries. With EPSS score of 0.04% (12th percentile) and no public exploit code identified, immediate mass exploitation appears unlikely, though administrator-level compromise could enable data exfiltration from WordPress databases.
Stored cross-site scripting (XSS) in WebCodingPlace Responsive Posts Carousel Pro WordPress plugin versions 15.2 and earlier allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability resides in improper input sanitization during web page generation, enabling attackers to compromise site integrity and steal sensitive user data. EPSS exploitation probability is notably low (0.04%, 14th percentile), suggesting limited real-world attack incentive despite the stored nature of the flaw.
Cross-Site Request Forgery in Premium Addons for Elementor plugin versions up to 4.11.53 allows unauthenticated remote attackers to create arbitrary Elementor templates by exploiting missing nonce validation in the 'insert_inner_template' function. An attacker must trick a site administrator or user with edit_posts capability into clicking a malicious link, but no public exploit code has been identified. The EPSS score of 0.02% indicates this vulnerability has very low exploitation probability in practice despite the CVSS 4.3 rating.
Unauthenticated attackers can access private, draft, and pending template content in Premium Addons for Elementor WordPress plugin (versions up to 4.11.53) due to a missing capability check in the 'get_template_content' function. This authentication bypass allows unauthorized disclosure of sensitive template data without requiring user interaction or special privileges. A vendor patch is available, and the vulnerability carries a moderate CVSS score of 5.3 with low technical impact but confirmed accessibility to restricted resources.
Cross-site request forgery (CSRF) in Kunal Custom 404 Pro WordPress plugin through version 3.12.0 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects all versions up to and including 3.12.0, with no CVSS score assigned at the time of analysis. No public exploit code has been identified, and the EPSS score of 0.02% indicates minimal likelihood of active exploitation despite the moderate technical severity of CSRF flaws.
Cross-site request forgery (CSRF) vulnerability in PluginOps Feather Login Page WordPress plugin versions up to 1.1.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. The vulnerability stems from missing CSRF token validation on plugin functionality, enabling attackers to craft malicious requests that execute when users visit attacker-controlled pages while logged into sites using the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis; however, the low EPSS score (0.02%) and lack of CVSS data suggest this may represent a lower-severity implementation gap rather than a critical attack vector in typical WordPress deployments.
Stored cross-site scripting (XSS) in Void Elementor WHMCS Elements for Elementor Page Builder through version 2.0.1.2 allows authenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially compromising site visitors and administrators. The vulnerability stems from improper input sanitization in page generation functions. No public exploit code or active exploitation has been identified, but the low EPSS score (0.04%) reflects limited real-world attack probability despite the high-impact nature of XSS vulnerabilities.
Stored cross-site scripting (XSS) in HappyDevs TempTool WordPress plugin version 1.3.1 and earlier allows authenticated attackers to inject malicious scripts that persist in the database and execute in the browsers of other users who view affected pages. The vulnerability exists in the [Show Current Template Info] functionality and affects the current-template-name component; exploitation requires an authenticated user with appropriate plugin permissions but can compromise all site visitors who interact with the injected content.
Stored cross-site scripting (XSS) in WP Microdata WordPress plugin version 1.0 and earlier allows authenticated users or lower-privileged administrators to inject malicious scripts that execute in the browsers of site visitors, potentially leading to credential theft, session hijacking, or malware distribution. The vulnerability stems from improper input sanitization during web page generation. EPSS score of 0.04% indicates low exploitation probability in real-world conditions.
HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions through 2.3.17) allows attackers to bypass access control restrictions and exploit incorrectly configured security levels, potentially enabling unauthorized access to protected content or administrative functions. The vulnerability stems from broken access control (CWE-862) with no public exploit code confirmed at time of analysis, though EPSS scoring of 0.04% suggests minimal real-world exploitation probability despite the authorization flaw.
DOM-based cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin versions up to 2.7.12 allows attackers to inject malicious scripts into web pages through improper input neutralization during page generation. The vulnerability affects WordPress sites using this Elementor page builder extension and can enable session hijacking, credential theft, or malware distribution against site visitors. EPSS exploitation probability is low at 0.04%, but the attack vector is likely network-based requiring no authentication.
Authorization bypass in RadiusTheme Radius Blocks WordPress plugin through version 2.2.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to restricted functionality. The vulnerability is classified as an insecure direct object reference (IDOR) issue affecting the plugin's access control implementation. While no CVSS score is available and EPSS indicates low exploitation probability (0.04%), the vulnerability demonstrates a fundamental authentication design flaw that could permit escalation of privileges within WordPress installations using this plugin.
Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).
Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).
Authorization bypass in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin through version 2.3.23 allows attackers to exploit incorrectly configured access control via user-controlled keys, potentially enabling unauthorized access to post content or plugin functionality. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key) and presents a low exploitation probability (EPSS 0.04%, 13th percentile) with no public exploit code or active exploitation confirmed at time of analysis.
WP AI CoPilot plugin for WordPress versions through 1.2.7 exposes sensitive information embedded within sent data, allowing attackers to retrieve confidential details without proper access controls. The vulnerability stems from inadequate handling of sensitive data in communications, classified as information disclosure with an EPSS score of 0.04% indicating low real-world exploitation probability. No public exploit code has been identified at time of analysis.
Unauthenticated access to sensitive data in Ays Pro Easy Form plugin for WordPress up to version 2.7.8 allows remote attackers to obtain information due to a missing authorization check. This vulnerability has a CVSS 7.5 base score, but EPSS indicates low exploitation probability (0.05%). No active exploitation (CISA KEV) or public exploit code exists at time of analysis.
Denial of service in the WordPress Offload, AI & Optimize with Cloudflare Images (cf-images) plugin up to version 1.9.5 allows low-privilege authenticated users to disrupt service availability through missing authorization checks. Any authenticated subscriber or similar low-level role can trigger the flaw to degrade or crash the service. No active exploitation or public PoC is known, and EPSS indicates a very low probability of real-world attacks.
Sensitive information disclosure in Magnigenie RestroPress WordPress plugin versions up to 3.2.3.5 allows authenticated attackers with low privileges to access restricted data via a missing authorization check. This vulnerability, tracked as CVE-2025-66100, has no known public exploit or active exploitation, and EPSS estimates a low probability of exploitation.
Unauthenticated information disclosure in PropertyHive plugin (≤2.1.12) allows remote attackers to access sensitive property data without authentication. The vulnerability stems from missing authorization checks on certain endpoints, effectively bypassing access controls. No active exploitation or public exploit code has been identified; EPSS score is very low.
Remote code execution in Hotel Booking Lite (motopress-hotel-booking-lite) for WordPress allows authenticated attackers with high privileges to inject and execute arbitrary code on the server via remote file inclusion. The flaw affects versions up to and including 5.2.3. No active exploitation or public proof-of-concept is reported, but the high CVSS score highlights severe impact if exploited by a compromised admin account.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.
Missing authorization in wpForo Forum up to version 2.4.10 allows remote unauthenticated attackers to access restricted forum content due to incorrectly configured access control security levels. The vulnerability is in the WordPress plugin and does not require user interaction; it results in high confidentiality impact with no integrity or availability effects. No active exploitation or public exploit code is known, and EPSS score of 0.05% indicates low exploitation likelihood.
Missing authorization check in Watu Quiz plugin for WordPress up to version 3.4.5 permits authenticated low-privilege users to perform unauthorized modifications, such as altering quiz content or settings. The flaw stems from incorrectly configured access control security levels, allowing attackers with subscriber or contributor roles to bypass intended restrictions. No active exploitation has been reported, and EPSS indicates low likelihood of widespread attacks.
Broken access control in Cooked WordPress plugin versions ≤1.11.3 allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. The vulnerability stems from missing authorization validation (CWE-862), enabling privilege escalation and unauthorized data manipulation. With CVSS 8.8 and EPSS probability of 0.06% (18th percentile), real-world exploitation risk is moderate; no public exploit identified at time of analysis.
Missing authorization in WP Document Revisions plugin ≤3.7.2 allows authenticated high‑privilege users to bypass access controls and modify document data without proper authorization. The vulnerability carries Low severity (CVSS 2.7) due to the high permission level required and limited integrity impact. No active exploitation or public exploit is currently known.
Cross-Site Request Forgery (CSRF) in the Vimeotheque plugin for WordPress (version 2.3.5.2 and earlier) allows unauthenticated attackers to trick authenticated users into performing state-changing actions, resulting in low integrity impact. The flaw carries a CVSS v3.1 score of 4.3 (Medium) but has an EPSS exploitation probability of only 0.02%, indicating very low real-world risk. No active exploitation or public exploit code has been identified at the time of analysis.
Cross-Site Request Forgery in the Fast User Switching WordPress plugin (versions ≤1.4.10) allows tricking an administrator into performing unintended user-switching actions. The flaw poses a medium risk (CVSS 4.3) but requires user interaction and is not currently known to be actively exploited nor publicly weaponized.
Missing authorization in the Funnelforms Free plugin for WordPress (versions up to 3.8) allows unauthenticated attackers to modify plugin data due to incorrectly configured access control. The vulnerability (CWE-862) has a CVSS 5.3 rating with low integrity impact only; no confidentiality or availability is affected. At the time of analysis, there is no evidence of active exploitation and the EPSS score is low (0.06%), indicating limited urgency.
Missing authorization in YITH Slider for page builders (WordPress plugin) allows authenticated low-privileged attackers to view and modify slider content without proper permission checks. Patches are implied in versions beyond 1.0.11. No active exploitation or public exploit code is currently known.
Cross-site request forgery in Advanced Classifieds & Directory Pro for WordPress up to version 3.2.9 allows unauthenticated attackers to perform unauthorized actions, such as modifying plugin settings, by tricking an authenticated administrator into clicking a crafted link. No public exploit or active exploitation is known, and EPSS gives a 0.02% probability of exploitation, indicating very low real-world risk.
Unauthorized modification of data in the WordPress FV Simpler SEO plugin versions up to and including 1.9.6 allows unauthenticated attackers to change plugin settings due to missing authorization checks. This vulnerability, reported by Patchstack, has a low predicted exploitation probability (EPSS 0.04%) and no public exploit or active exploitation identified at time of analysis.
Unauthorized data modification via missing authorization in the Addonify Quick View WordPress plugin (<= 2.0.4) allows remote, unauthenticated attackers to alter plugin settings or content due to missing capability checks on an AJAX endpoint. No active exploitation or public exploit code is known, and EPSS assigns a very low exploitation probability (0.04%).
Missing authorization in the Virusdie WordPress plugin (≤ 1.1.6) allows authenticated low-privilege users to exploit incorrectly configured access controls, potentially leading to unauthorized changes to plugin settings. The vulnerability is not known to be actively exploited, with a low EPSS score (0.06%), and no public exploit code has been identified at time of analysis.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Authorization bypass in Wappointment WordPress plugin versions ≤2.7.6 enables low-privileged authenticated attackers to perform unauthorized actions with high impact to confidentiality, integrity, and availability. The vulnerability stems from missing authorization checks (CWE-862), allowing authenticated users to access or modify data beyond their intended permission level. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, and no confirmed active exploitation (CISA KEV) or public exploit code is identified at time of analysis.
Cross-site scripting in WPBakery Visual Composer WHMCS Elements plugin for WordPress allows authenticated attackers with high privileges to inject malicious scripts via DOM manipulation. This XSS can lead to limited data disclosure or actions within the victim's session but requires user interaction. No public exploit or active exploitation reported.
Cross-site request forgery in Simple Keyword to Link WordPress plugin version 1.5 and below allows unauthenticated attackers to trick authenticated administrators into modifying keyword-to-link associations through crafted requests. No active exploitation or public exploit code has been identified, and the low EPSS score suggests a low probability of widespread attacks.
Unauthenticated missing authorization flaw in the BBP Core WordPress plugin (versions ≤1.4.1) allows attackers to modify certain data with low integrity impact. No confidentiality is exposed. The flaw, assigned CWE-862, has a CVSS base score of 5.3 (Medium) but is not actively exploited.
Broken access control in SALESmanago WordPress plugin allows authenticated attackers with low-level privileges to bypass authorization checks and gain unauthorized access to high-privilege functions. Affects versions up to 3.9.0. The vulnerability enables complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Broken access control in WP Time Slots Booking Form plugin (≤1.2.39) allows authenticated attackers with low-level privileges to escalate permissions and execute unauthorized administrative actions. The vulnerability stems from missing authorization checks (CWE-862), enabling privilege escalation to access, modify, or delete sensitive booking data and configuration settings. While CVSS scores 8.8 (High), real-world risk appears moderate with EPSS at 0.06% (18th percentile) and no public exploit identified at time of analysis.
Missing authorization in Claspo WordPress plugin through version 1.0.7 allows unauthenticated remote attackers to modify data via incorrectly configured access controls. With CVSS 7.5 (High integrity impact) but only 0.04% EPSS probability, this represents elevated exposure in vulnerable installations despite low observed exploitation likelihood. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized actions without credentials.
Cross-Site Request Forgery in WordPress plugin My Auctions Allegro (versions ≤3.6.33) allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through social engineering. CVSS 8.8 severity stems from potential high confidentiality, integrity, and availability impact if victims are tricked into clicking malicious links while authenticated. EPSS score of 0.02% (6th percentile) indicates very low probability of exploitation in the wild. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring user interaction.
Stored cross-site scripting (XSS) in WordPress plugin My auctions allegro (versions up to 3.6.35) allows authenticated users to inject malicious scripts that execute in other users' browsers when viewing auction content. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected WordPress installations, though with limited scope within the plugin context. No public exploit code or active exploitation has been identified; real-world risk is moderate given the requirement for authenticated access and user interaction.
Missing authorization in Twitch Player WordPress plugin (ttv-easy-embed-player) versions up to 2.1.3 allows remote unauthenticated attackers to trigger a denial-of-service condition via exploitation of incorrectly configured access control security levels. This CWE-862 vulnerability impacts only availability and has no confidentiality or integrity impact. No active exploitation or public exploit code is confirmed at this time; EPSS indicates a 0.06% probability of exploitation in the next 30 days.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Unauthorized modification possible in the Sunshine Photo Cart WordPress plugin up to version 3.5.7.1 due to missing authorization checks. Authenticated low-privileged users can exploit misconfigured access controls to alter data they should not have access to. No active exploitation or public exploit is known, and EPSS indicates a 0.04% probability of exploitation in the next 30 days.
Stored cross-site scripting in HasThemes WC Builder WordPress plugin up to version 1.2.0 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages created with the plugin. When victims view the crafted page, the script executes in their browser, leading to potential data theft or session hijacking.
Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).
Unauthorized setting modification in the WP Email Capture WordPress plugin through version 3.12.5 allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as altering email capture settings. The vulnerability requires user interaction and has very low exploitation probability (EPSS 0.02%); no active exploitation or public exploit code is known.
Stored cross-site scripting in the Academy LMS WordPress plugin up to version 3.4.0 allows authenticated attackers with low privileges to inject JavaScript into web pages viewed by other users. No evidence of active exploitation or public exploit code exists; EPSS indicates a very low exploitation probability (0.04%).
Stored Cross-Site Scripting in the pixelgrade Category Icon WordPress plugin through version 1.0.2 enables authenticated administrators to inject malicious scripts that execute in other users' browsers, leading to low-impact compromise of confidentiality and integrity. No active exploitation or public proof-of-concept code is currently known, and EPSS indicates a low exploitation probability (0.04%).
Authenticated data modification in the Spiffy Calendar WordPress plugin allows low-privilege attackers to edit calendar events without proper authorization. The vulnerability affects all plugin versions up to and including 5.0.7. No active exploitation or public exploit code has been observed, and EPSS indicates a negligible chance of widespread exploitation.
Information disclosure in WpStream plugin for WordPress up to version 4.9.5 allows authenticated low-privileged users to read sensitive configuration data due to a missing authorization check (CWE-862). The vulnerability requires a subscriber-level account and exposes limited confidentiality information without affecting integrity or availability. No active exploitation or public exploit code has been identified at time of analysis.
Low-integrity unauthorized modification in WpStream plugin ≤4.9.5 allows unauthenticated remote attackers to alter plugin functionality via missing authorization checks. The vulnerability, classified as CWE-862 Missing Authorization, enables attackers to exploit incorrectly configured access control levels, potentially changing streaming settings or data without any user interaction. No public exploit or active exploitation has been confirmed, and EPSS score is very low (0.06%).
Missing authorization in the Tablesome WordPress plugin allows authenticated low-privilege users to modify or disrupt plugin data. Affected versions up to 1.1.35.1; no active exploitation or public exploit identified at this time.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Stored cross-site scripting in the Bold Timeline Lite plugin for WordPress allows authenticated attackers to inject arbitrary web scripts. Versions up to and including 1.2.7 are affected, enabling an attacker with low privileges to store a payload that executes when a victim views an infected timeline page. The CVSS 6.5 rating reflects medium severity, but the very low EPSS exploitation probability (0.04%) suggests minimal real-world threat; no public exploit or active exploitation is known.
Stored cross-site scripting in Real 3D FlipBook plugin up to version 4.11.4 allows authenticated users with low privileges to inject malicious scripts that execute in victim browsers. This can lead to session hijacking or
Missing authorization in Gutenverse Form plugin for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, resulting in a high availability impact. Versions up to and including 2.3.1 are affected, and no active exploitation has been reported.
An open redirect vulnerability in Jeff Starr's User Submitted Posts WordPress plugin allows attackers to craft malicious URLs that redirect victims to untrusted websites for phishing. All plugin versions up to and including 20251121 are affected, requiring user interaction to trigger. Public exploit code is available
Missing authorization in the Brave Popup Builder WordPress plugin (version <= 0.8.3) allows unauthenticated attackers to access functionality not properly restricted by access controls. Exploitation could lead to disclosure of sensitive information with no user interaction required. EPSS suggests a very low exploitation probability (0.04%) and no public exploit code has been identified.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Unauthenticated information disclosure in the H5P WordPress plugin up to version 1.16.1 allows remote attackers to access sensitive data due to missing authorization checks. No authentication is required, but only low confidentiality impact is expected. No public exploit has been identified, and exploitation is not known to be active.
Server-side request forgery (SSRF) in the BdThemes Prime Slider addon for Elementor (up to version 4.0.10)
Stored cross-site scripting in Astra Widgets WordPress plugin up to version 1.2.16 allows authenticated attackers with admin access to inject malicious scripts that execute when other users view pages containing affected widgets. No public exploit or active exploitation has been reported, and EPSS probability is low (0.04%).
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
PHP object injection in Icegram Express Pro (WordPress email marketing plugin) through version 5.9.13 enables unauthenticated remote attackers to execute arbitrary code via unsafe deserialization of user-controlled data. With CVSS 9.8 (critical severity) and network-accessible attack vector requiring no authentication or user interaction, this represents a severe pre-authentication RCE risk. EPSS score of 0.06% (19th percentile) suggests low immediate exploitation probability, and no public exploit or CISA KEV listing identified at time of analysis, though Patchstack disclosure increases attacker awareness.
DOM-based Cross-Site Scripting in the Greenhouse Job Board WordPress plugin versions up to 2.7.3 allows authenticated administrators to inject arbitrary scripts. A victim admin browsing a page where the payload is rendered could have their browser execute the malicious code, leading to session hijacking or data theft. At time of analysis, no active exploitation or public exploit is known.
DOM-based cross-site scripting (XSS) in the GARD AdSense plugin for WordPress versions ≤2.23 allows authenticated administrators to inject malicious scripts that execute in the browser of a victim who interacts with a crafted link. Exploitation requires high-privilege user access and victim user interaction, and no public exploit or active attacks are known (EPSS 0.04%).
Stored cross-site scripting in the WordPress Gift Hunt plugin up to version 2.0.2 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when other users view the affected plugin pages. This can lead to session hijacking, credential theft, or unauthorized actions within the site. EPSS indicates very low exploitation probability (0.04%), no active exploitation is known, and no public proof-of-concept has been identified.
Stored cross-site scripting in WordPress WH Tweaks plugin up to version 1.0.2 allows authenticated administrators to inject web scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires high privileges (admin) and user interaction (victim must view the poisoned page), with no public exploit or active exploitation confirmed. Its CVSS base score of 5.9 indicates a moderate risk primarily for sites where untrusted individuals may hold administrator roles.
Stored cross-site scripting in the Basticom Framework WordPress plugin up to version 1.5.2 enables authenticated administrators to inject arbitrary web scripts. These scripts execute in the browsers of other users who view the affected page, potentially leading to session hijacking, phishing, or defacement. No active exploitation or public exploit code has been identified at time of analysis, and the EPSS likelihood is very low (0.04%).
Stored cross-site scripting in the WordPress Review Disclaimer plugin versions up to 2.0.3 allows authenticated high-privilege attackers (e.g., admin) to inject arbitrary web scripts that execute in the browsers of other users. While no active exploitation is confirmed and the EPSS likelihood is very low (0.04%), a successful attack could lead to session theft or site defacement when a victim views the injected content.
Stored cross-site scripting in the TouchOfTech Draft Notify WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users’ browsers when they view affected pages. Versions up to and including 1.5 are vulnerable. The flaw is not actively exploited, and no public exploit code has been identified.
Cross-Site Request Forgery in the Trade Runner WordPress plugin (versions ≤ 3.14) allows a remote attacker to trick a logged-in administrator into submitting a forged request, resulting in unauthorized low-impact data modification. The vulnerability is not listed in CISA KEV and has no known public exploit, with EPSS score indicating very low exploitation likelihood.
Server-Side Request Forgery (SSRF) in 6Storage Rentals WordPress plugin versions ≤2.20.2 allows unauthenticated remote attackers to send crafted requests from the vulnerable server to arbitrary internal or external systems. With CVSS 9.1 (critical) due to network-accessible attack vector requiring no authentication or user interaction, attackers can achieve high confidentiality and integrity impact by potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive data. EPSS score of 0.04% (14th percentile) indicates relatively low observed exploitation probability despite the critical severity rating. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Cross-site scripting (XSS) vulnerability in CodexThemes TheGem Theme Elements (for Elementor) plugin through version 5.10.5.1 allows improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially compromising WordPress site visitors and administrators. No active exploitation has been confirmed at time of analysis, though the low EPSS score (0.04%) suggests limited real-world exploitation likelihood despite the vulnerability's presence in a widely-used Elementor theme plugin.
Chakra test WordPress plugin version 1.0.1 and earlier fails to properly enforce access control restrictions, allowing unauthenticated or lower-privileged users to bypass authentication mechanisms and access restricted functionality. The vulnerability stems from incorrectly configured security levels that do not validate user permissions before executing sensitive operations, and is tracked with an exceptionally low EPSS score (0.04%) despite the missing authorization flaw, suggesting limited real-world exploitation despite the theoretical risk.
Missing authorization controls in VillaTheme HAPPY helpdesk plugin versions up to 1.0.9 allow unauthenticated attackers to bypass access restrictions and interact with support ticket functionality without proper permission verification. This authentication bypass vulnerability affects WordPress installations using the vulnerable plugin and could permit unauthorized access to sensitive support tickets and helpdesk operations. The issue has been reported by Patchstack security researchers with a low EPSS exploitation probability (0.04%) despite the authorization flaw.
VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.
Blind SQL injection in WPBulky WordPress plugin through version 1.1.13 allows high-privileged authenticated attackers to extract database contents and potentially cause limited service disruption. The vulnerability exists in the bulk edit functionality where user-supplied input is improperly sanitized before inclusion in SQL queries. With EPSS score of 0.04% (12th percentile) and no public exploit code identified, immediate mass exploitation appears unlikely, though administrator-level compromise could enable data exfiltration from WordPress databases.
Stored cross-site scripting (XSS) in WebCodingPlace Responsive Posts Carousel Pro WordPress plugin versions 15.2 and earlier allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability resides in improper input sanitization during web page generation, enabling attackers to compromise site integrity and steal sensitive user data. EPSS exploitation probability is notably low (0.04%, 14th percentile), suggesting limited real-world attack incentive despite the stored nature of the flaw.
Cross-Site Request Forgery in Premium Addons for Elementor plugin versions up to 4.11.53 allows unauthenticated remote attackers to create arbitrary Elementor templates by exploiting missing nonce validation in the 'insert_inner_template' function. An attacker must trick a site administrator or user with edit_posts capability into clicking a malicious link, but no public exploit code has been identified. The EPSS score of 0.02% indicates this vulnerability has very low exploitation probability in practice despite the CVSS 4.3 rating.
Unauthenticated attackers can access private, draft, and pending template content in Premium Addons for Elementor WordPress plugin (versions up to 4.11.53) due to a missing capability check in the 'get_template_content' function. This authentication bypass allows unauthorized disclosure of sensitive template data without requiring user interaction or special privileges. A vendor patch is available, and the vulnerability carries a moderate CVSS score of 5.3 with low technical impact but confirmed accessibility to restricted resources.
Cross-site request forgery (CSRF) in Kunal Custom 404 Pro WordPress plugin through version 3.12.0 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects all versions up to and including 3.12.0, with no CVSS score assigned at the time of analysis. No public exploit code has been identified, and the EPSS score of 0.02% indicates minimal likelihood of active exploitation despite the moderate technical severity of CSRF flaws.
Cross-site request forgery (CSRF) vulnerability in PluginOps Feather Login Page WordPress plugin versions up to 1.1.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. The vulnerability stems from missing CSRF token validation on plugin functionality, enabling attackers to craft malicious requests that execute when users visit attacker-controlled pages while logged into sites using the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis; however, the low EPSS score (0.02%) and lack of CVSS data suggest this may represent a lower-severity implementation gap rather than a critical attack vector in typical WordPress deployments.
Stored cross-site scripting (XSS) in Void Elementor WHMCS Elements for Elementor Page Builder through version 2.0.1.2 allows authenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially compromising site visitors and administrators. The vulnerability stems from improper input sanitization in page generation functions. No public exploit code or active exploitation has been identified, but the low EPSS score (0.04%) reflects limited real-world attack probability despite the high-impact nature of XSS vulnerabilities.
Stored cross-site scripting (XSS) in HappyDevs TempTool WordPress plugin version 1.3.1 and earlier allows authenticated attackers to inject malicious scripts that persist in the database and execute in the browsers of other users who view affected pages. The vulnerability exists in the [Show Current Template Info] functionality and affects the current-template-name component; exploitation requires an authenticated user with appropriate plugin permissions but can compromise all site visitors who interact with the injected content.
Stored cross-site scripting (XSS) in WP Microdata WordPress plugin version 1.0 and earlier allows authenticated users or lower-privileged administrators to inject malicious scripts that execute in the browsers of site visitors, potentially leading to credential theft, session hijacking, or malware distribution. The vulnerability stems from improper input sanitization during web page generation. EPSS score of 0.04% indicates low exploitation probability in real-world conditions.
HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions through 2.3.17) allows attackers to bypass access control restrictions and exploit incorrectly configured security levels, potentially enabling unauthorized access to protected content or administrative functions. The vulnerability stems from broken access control (CWE-862) with no public exploit code confirmed at time of analysis, though EPSS scoring of 0.04% suggests minimal real-world exploitation probability despite the authorization flaw.
DOM-based cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin versions up to 2.7.12 allows attackers to inject malicious scripts into web pages through improper input neutralization during page generation. The vulnerability affects WordPress sites using this Elementor page builder extension and can enable session hijacking, credential theft, or malware distribution against site visitors. EPSS exploitation probability is low at 0.04%, but the attack vector is likely network-based requiring no authentication.
Authorization bypass in RadiusTheme Radius Blocks WordPress plugin through version 2.2.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to restricted functionality. The vulnerability is classified as an insecure direct object reference (IDOR) issue affecting the plugin's access control implementation. While no CVSS score is available and EPSS indicates low exploitation probability (0.04%), the vulnerability demonstrates a fundamental authentication design flaw that could permit escalation of privileges within WordPress installations using this plugin.
Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).
Arbitrary file download in WordPress Tuturn plugin before version 3.6 allows authenticated users to read sensitive server files. No active exploitation or public exploit code has been reported; EPSS exploitation probability is low (0.07%).
Authorization bypass in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin through version 2.3.23 allows attackers to exploit incorrectly configured access control via user-controlled keys, potentially enabling unauthorized access to post content or plugin functionality. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key) and presents a low exploitation probability (EPSS 0.04%, 13th percentile) with no public exploit code or active exploitation confirmed at time of analysis.
WP AI CoPilot plugin for WordPress versions through 1.2.7 exposes sensitive information embedded within sent data, allowing attackers to retrieve confidential details without proper access controls. The vulnerability stems from inadequate handling of sensitive data in communications, classified as information disclosure with an EPSS score of 0.04% indicating low real-world exploitation probability. No public exploit code has been identified at time of analysis.
Unauthenticated access to sensitive data in Ays Pro Easy Form plugin for WordPress up to version 2.7.8 allows remote attackers to obtain information due to a missing authorization check. This vulnerability has a CVSS 7.5 base score, but EPSS indicates low exploitation probability (0.05%). No active exploitation (CISA KEV) or public exploit code exists at time of analysis.
Denial of service in the WordPress Offload, AI & Optimize with Cloudflare Images (cf-images) plugin up to version 1.9.5 allows low-privilege authenticated users to disrupt service availability through missing authorization checks. Any authenticated subscriber or similar low-level role can trigger the flaw to degrade or crash the service. No active exploitation or public PoC is known, and EPSS indicates a very low probability of real-world attacks.
Sensitive information disclosure in Magnigenie RestroPress WordPress plugin versions up to 3.2.3.5 allows authenticated attackers with low privileges to access restricted data via a missing authorization check. This vulnerability, tracked as CVE-2025-66100, has no known public exploit or active exploitation, and EPSS estimates a low probability of exploitation.
Unauthenticated information disclosure in PropertyHive plugin (≤2.1.12) allows remote attackers to access sensitive property data without authentication. The vulnerability stems from missing authorization checks on certain endpoints, effectively bypassing access controls. No active exploitation or public exploit code has been identified; EPSS score is very low.
Remote code execution in Hotel Booking Lite (motopress-hotel-booking-lite) for WordPress allows authenticated attackers with high privileges to inject and execute arbitrary code on the server via remote file inclusion. The flaw affects versions up to and including 5.2.3. No active exploitation or public proof-of-concept is reported, but the high CVSS score highlights severe impact if exploited by a compromised admin account.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.
Missing authorization in wpForo Forum up to version 2.4.10 allows remote unauthenticated attackers to access restricted forum content due to incorrectly configured access control security levels. The vulnerability is in the WordPress plugin and does not require user interaction; it results in high confidentiality impact with no integrity or availability effects. No active exploitation or public exploit code is known, and EPSS score of 0.05% indicates low exploitation likelihood.