Wordpress Plugin
Monthly
Permission bypass in Wbcom Designs lock-my-bp WordPress plugin through 2.1.1 allows unauthenticated attackers to modify plugin settings or data due to missing authorization checks. This vulnerability, classified as CWE-862 Missing Authorization, enables unauthorized integrity impact with no confidentiality or availability consequences. The low EPSS score (0.05%) indicates limited exploitation likelihood, and no active exploitation or public exploit code has been reported.
Missing authorization in the TrueBooker WordPress plugin allows unauthenticated attackers to remotely modify appointment booking data. The vulnerability affects versions up to and including 1.1.0 and is classified as CWE-862. No active exploitation or public exploit is known, and EPSS estimates a very low exploitation probability (0.05%).
Unauthorized data modification in the WP Email Capture plugin for WordPress up to version 3.12.4 allows unauthenticated attackers to alter email capture settings or data through missing authorization checks. The vulnerability has a CVSS base score of 5.3 with low integrity impact and no confidentiality or availability impact. No active exploitation or public proof-of-concept has been identified, and the vulnerability is considered low risk.
Unauthenticated integrity impact in Easy Form Builder plugin up to 3.8.20 allows remote attackers to modify form settings or data due to missing authorization checks. The vulnerability, classified as CWE-862 (Missing Authorization), poses a medium severity risk (CVSS 5.3) with low integrity impact. No active exploitation or public exploit code has been identified at this time.
Unauthenticated access to a restricted endpoint in the Sitewide Notice WP WordPress plugin (versions up to 2.4.1) allows attackers to exploit a missing authorization check, resulting in low-impact availability disruption. The vulnerability requires no credentials or user interaction, but the impact is limited to minor service degradation (e.g., toggling notice state). No public exploit code or active exploitation has been identified; EPSS indicates very low exploitation probability.
Missing authorization checks in wpdevart Booking Calendar WordPress plugin (versions ≤ 3.2.30) allow unauthenticated remote attackers to modify appointment booking data, resulting in low integrity impact. The vulnerability has a CVSS base score of 5.3, EPSS score 0.05% (16th percentile), and no known active exploitation or public exploit code.
Missing authorization in the Woffice Core WordPress plugin ≤5.4.30 allows unauthenticated remote attackers to cause limited denial-of-service (availability impact) by exploiting incorrectly configured access control. No confidentiality or integrity impact has been identified. EPSS indicates very low exploitation probability (0.05%) and no active exploitation or public exploit code is known.
Missing authorization in Post SMTP WordPress plugin (≤3.6.1) allows unauthenticated remote attackers to perform restricted administrative actions due to improperly enforced access control on one or more plugin endpoints. Reported by Patchstack and tracked as CWE-862, the flaw permits integrity-affecting operations without requiring any authentication or user interaction. No public exploit code exists and EPSS sits at 0.05% (16th percentile), indicating low observed exploitation interest at time of analysis.
Incorrectly configured access control in WebCodingPlace Image Caption Hover Pro allows authenticated attackers with low privileges to modify plugin data and disrupt service. The vulnerability affects all plugin versions prior to 20.0 and requires only a low-privilege account on the WordPress site. Exploitation probability is very low (EPSS 0.05%) and no active attacks are reported.
Privilege escalation through missing authorization in the WordPress Debug Log Viewer plugin (≤2.0.3) allows authenticated low-privilege users to view and modify debug logs, exposing sensitive data such as database credentials or error details. No active exploitation or public PoC is currently known, and the EPSS score is extremely low (0.03%).
Broken access control in the Listdom WordPress plugin up to version 5.0.1 allows authenticated low-privileged attackers to modify data and potentially disrupt service, as missing authorization checks can be exploited without user interaction. No active exploitation or public exploit has been reported at the time of analysis, and EPSS indicates a very low probability (0.05%) of exploitation.
Low-privilege WordPress users can modify booking data and disrupt scheduling in vcita Meeting Scheduler plugin versions up to 4.5.5 due to missing authorization checks. Exploitation requires an authenticated subscriber-level account but has no user interaction, allowing unauthorized integrity and availability impact. No active exploitation or public exploit code has been identified.
Stored cross-site scripting in the Rencontre WordPress plugin up to version 3.13.7 allows authenticated attackers with high privileges to inject malicious scripts into fields rendered on pages accessed by other users. Successful exploitation could lead to session hijacking, data exfiltration, or defacement when victims view the affected content. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting (XSS) in the Calendly Embedder WordPress plugin (versions ≤ 1.1.7.2) allows authenticated administrators to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability requires high privileges and user interaction, resulting in low confidentiality, integrity, and availability impact. No active exploitation or public exploit code is known, and EPSS indicates a 0.06% probability of exploitation.
Missing authorization in WP Delicious plugin versions up to 1.9.1 enables authenticated attackers with low privileges (e.g., subscriber) to modify data with high integrity impact. This WordPress plugin vulnerability (CWE-862) has a CVSS base score of 6.5, no confidentiality impact, and requires no user interaction. At this time, no public exploit code or active exploitation has been reported.
Stored cross-site scripting vulnerability in the WP-ShowHide WordPress plugin (versions through 1.05) allows authenticated attackers with contributor-level access to inject arbitrary web scripts. When a
We are tasked with synthesizing data about CVE-2025-67534 into a comprehensive JSON analysis. We must use ALL provided data: references, EPSS, KEV status (not mentioned, assume false), patch availability, CPE strings (none provided), and tags (CSRF, XSS). First, parse the description: "Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7." CVSS: 7.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CWE-352. EPSS: 0.03% (low). No KEV mentioned, so not actively exploited. No POC data. Patch? Reference is a Patchstack database entry for a WordPress plugin. We need to infer patch availability. The reference URL likely describes the vulnerability and might say if a patch exists. Since no explicit fix version is mentioned beyond "<= 3.13.7", it's probable that the next version after 3.13.7 is a fix, but not confirmed. I'll say "Patch availability not confirmed; likely fix in version >3.13.7" but careful: rule says "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". We don't have explicit patch data. I'll note: "Upstream fix not independently confirmed; likely version after 3.13.7 addresses the issue" but avoid inventing version numbers. For remediation, I can say "Upgrade to Rencontre version 3.13.8 or higher if available, or apply vendor-provided patch" but careful: we only know <= 3.13.7 affected, so fix version would be 3.13.8. Patchstack might indicate the fix version. Since the reference is a Patchstack URL, they usually show the fixed version. So I'll assume the fix is in a later version. I'll state: "Vendor patch likely available in version 3.13.8 or later" but the rule says to cite exact fix versions from input data. The input data doesn't mention a specific fix version, only "through <= 3.13.7". I'll check: "Patch available per vendor advisory" would fit if the advisory says patch available. The reference URL is
Stored cross-site scripting in the Themify Portfolio Post WordPress plugin through version 1.3.0 allows authenticated attackers to embed arbitrary web scripts into portfolio items, which execute in victims’ browsers upon viewing. This can enable session theft, credential capture, or malicious redirects. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low (0.06%).
Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.
Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.
Authenticated SQL injection in the Media Library Tools WordPress plugin (≤1.6.15) allows high-privilege attackers to extract sensitive database information, with CVSS 7.6 signaling high confidentiality impact but limited integrity impact; no active exploitation or public exploit code is known, and EPSS indicates very low exploitation probability (0.06%).
SQL injection in the Ninja Tables WordPress plugin (≤5.2.3) enables authenticated administrators to extract sensitive database contents. The flaw allows high-privileged users to perform unauthorized SQL queries, compromising confidentiality with limited availability impact. No active exploitation or public PoC has been reported, and EPSS indicates very low exploitation probability.
Blind SQL injection in LambertGroup Accordion Slider PRO WordPress plugin versions through 1.2 allows authenticated attackers to exfiltrate sensitive database information. An attacker with low-privilege access (such as a subscriber) can execute arbitrary SQL queries via vulnerable plugin parameters, potentially accessing all database contents. No public exploit code or active exploitation has been reported, though the vulnerability carries a high confidentiality impact.
Blind SQL injection in the ArtPlacer Widget WordPress plugin (versions through 2.22.9.2) allows an authenticated low-privilege attacker to extract database contents via crafted requests to a vulnerable endpoint. The vulnerability carries a scope-changed CVSS rating because the WordPress database is shared across plugins and core, meaning successful exploitation can expose credentials, user data, and content belonging to other installed components - not just the ArtPlacer plugin itself. No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score (0.06%, 19th percentile) reflects minimal current attacker interest.
A cross-site request forgery vulnerability in the CWW Companion WordPress plugin up to version 1.3.2 allows unauthenticated attackers to trick admin users into performing unintended actions, such as modifying plugin
Cross-site request forgery in vcita Online Booking & Scheduling Calendar plugin for WordPress versions <=4.5.5 enables an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying calendar settings, due to missing CSRF token validation. No known active exploitation or public exploit code exists; EPSS predicts very low exploitation likelihood (0.03%).
Cross-Site Request Forgery in the Quick Contact Form WordPress plugin through version 8.2.5 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying form settings. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world exploitation.
Cross-site request forgery (CSRF) in the kubiq PDF Thumbnail Generator WordPress plugin (versions through 1.4) allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Successful exploitation requires user interaction, such as tricking an admin to click a link, and could result in limited integrity impact, like altering plugin settings. No public exploit code or active exploitation has been reported; EPSS indicates a very low exploitation probability.
Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.
Cross-site request forgery in GiveWP plugin through version 4.13.1 allows remote attackers to trick authenticated administrators into performing unauthorized actions, such as tampering with donation settings. The vulnerability requires user interaction and has a medium CVSS score of 5.4, with no active exploitation or public proof-of-concept identified. EPSS probability is very low at 0.02%.
Missing authorization in the Trinity Audio WordPress plugin up to version 5.23.3 allows authenticated attackers with low privileges to modify plugin data without the required capabilities, leading to potential integrity issues on affected sites. The vulnerability has a medium CVSS score of 4.3 and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public exploit code at this time.
Cross-site request forgery (CSRF) vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying or deleting link directory entries. Affects versions up to and including 8.8.3. No active exploitation or public exploit has been reported, and the EPSS score is low (0.03%).
Arbitrary shortcode execution in GiveWP plugin for WordPress up to version 4.13.1 allows unauthenticated remote attackers to inject and execute arbitrary shortcodes, potentially leading to information disclosure or full code execution depending on the site's installed shortcodes. The vulnerability is categorized as code injection (CWE-94) with a CVSS base score of 5.3, reflecting only confidentiality impact in the official scoring, though advisory tags suggest RCE capability. No active exploitation or public exploit code is known, and EPSS predicts a very low 0.04% exploitation probability.
Cross-site request forgery in the Salon booking system plugin for WordPress (versions up to 10.30.3) allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as modifying settings or deleting bookings. Exploitation requires tricking a logged-in administrator into clicking a malicious link; no public exploit code or active exploitation has been identified at this time. EPSS score is 0.03%, indicating very low probability of widespread exploitation.
Insufficient access controls in Webba Booking plugin for WordPress (versions up to 6.2.1) allow authenticated attackers with low privileges to modify booking data. EPSS score is low, and no active exploitation is reported.
Cross-site request forgery in Ays Pro Chartify plugin for WordPress through version 3.6.3 allows an attacker to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified at this time, and the exploitation probability is low (EPSS 0.03%). The vulnerability could lead to modification of chart builder settings but cannot compromise confidentiality or availability.
An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.
Information disclosure in the My Tickets WordPress plugin through 2.1.0 allows authenticated attackers with low privileges to access sensitive data via a missing authorization check. The vulnerability has a CVSS base score of 4.3, low EPSS exploitation probability (0.05%), and is not listed in CISA KEV nor associated with public exploit code.
Cross-Site Request Forgery in PressTigers Simple Folio WordPress plugin up to version 1.1.0 allows an unauthenticated remote attacker to trick an administrator into performing unintended state-changing actions, such as modifying plugin settings, resulting in low integrity impact. User interaction is required to exploit this vulnerability; no confidentiality or availability impact occurs. At the time of analysis, no active exploitation or public exploit code has been identified, and the EPSS score is very low (0.03%), indicating low likelihood of widespread attacks.
Missing authorization in the Admin and Site Enhancements (ASE) WordPress plugin up to version 8.0.8 allows authenticated high-privilege attackers to make low-impact modifications without proper access controls. With a CVSS score of 2.7, EPSS 0.07%, and no known active exploitation or public exploit, the risk is low for most environments.
Missing authorization in the Photo Block WordPress plugin allows authenticated users with high privileges (administrator) to exploit improperly configured access control to modify data they should not have access to, resulting in a low integrity impact. The vulnerability affects all plugin versions up to and including 1.5.1, with no confidentiality or availability compromise. No active exploitation or public exploit code is known at the time of analysis, and EPSS assigns a minimal exploitation probability of 0.07%.
Happy Addons for Elementor through version 3.20.3 allows authenticated users to access functionality they should not have permission to use due to missing authorization checks on API endpoints or admin functions. The vulnerability requires valid user authentication and results in information disclosure, with a CVSS score of 4.3 and an extremely low EPSS exploitation probability of 0.04%, suggesting minimal real-world attack incentive despite the access control flaw.
Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.
Media Library Assistant WordPress plugin through version 3.29 allows authenticated users to bypass authorization controls and access or modify content they should not have permission to reach via user-controlled keys in access control mechanisms. The vulnerability requires an authenticated user with limited privileges (PR:L) and affects confidentiality and integrity of stored media library data, though with relatively low exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.
Unauthorized information disclosure in the Yandex.Metrica WordPress plugin (versions up to 1.2.2) allows unauthenticated attackers to access sensitive data via missing authorization checks. No public exploit code or active exploitation has been identified at this time; the EPSS probability of exploitation is very low (0.05%).
Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
DOM-based cross-site scripting in WordPress plugin WP Ultimate Review versions ≤2.3.7 allows remote attackers to execute malicious JavaScript in victims' browsers via crafted input that is improperly sanitized during client-side page rendering. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering or malicious links. Exploitation probability is low (EPSS 0.04%, 14th percentile), with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Authenticated users can access sensitive contact form data and functionality they should not have permission to view or modify due to missing authorization checks in Contact Form by BestWebSoft plugin versions up to 4.3.6. The vulnerability allows logged-in attackers with low-level privileges to bypass access controls and view contact information or modify form settings with only network access and no additional user interaction required. This is not actively exploited according to available intelligence, though the access control bypass pattern is a common attack vector.
Missing authorization in ExpressTech Systems Quiz And Survey Master WordPress plugin through version 10.3.2 allows unauthenticated remote attackers to read sensitive quiz and survey data by exploiting incorrectly configured access control security levels. The vulnerability is assigned CVSS 5.3 (moderate), affects the plugin across multiple versions, and enables unauthorized information disclosure without requiring authentication or user interaction.
Stored cross-site scripting in the REHub Framework WordPress plugin versions below 19.9.9.7 permits authenticated attackers to inject malicious scripts. When a victim, such as an administrator, views the tainted content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability has a low EPSS score (0.06%) and no public exploit or reported active exploitation.
Missing authorization in ListingPro Lead Form plugin for WordPress enables unauthenticated attackers to modify lead data due to improper access controls. Affects versions up to 1.0.7. No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.05% indicates low current exploitation probability, though the remote unauthenticated nature makes the vulnerability easily exploitable if targeted.
DOM-based Cross-Site Scripting in the CridioStudio ListingPro Lead Form plugin for WordPress allows authenticated attackers with low privileges to inject arbitrary JavaScript into pages viewed by other users. Exploitation requires the attacker to submit crafted input via the vulnerable lead form and convince a victim to visit a page where the tainted data is rendered unsafely, enabling session hijacking, phishing, or browser-based attacks. No active exploitation or public exploit code has been identified.
A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.
A missing authorization check in the Steve Truman Page View Count WordPress plugin (≤ 2.9.0) allows authenticated attackers with low privileges to modify plugin settings without appropriate access controls. This can lead to limited integrity and availability impacts, such as disrupting plugin functionality or altering its behavior. The vulnerability has a low EPSS exploitation probability (0.05%) and is not known to be actively exploited in the wild.
Stored XSS in Make Section & Column Clickable For Elementor WordPress plugin (versions through 2.4) allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects site confidentiality, integrity, and availability with limited scope. EPSS score of 0.04% indicates low exploitation probability despite the presence of a public vulnerability disclosure.
Cross-Site Request Forgery in WordPress New User Approve plugin (versions ≤3.2.3) enables unauthenticated remote attackers to trick authenticated administrators into executing unauthorized actions via crafted requests. With EPSS probability of 0.02% (5th percentile) and no evidence of active exploitation (not in CISA KEV), this represents a moderate real-world risk despite a CVSS 7.1 score. The vulnerability requires user interaction (UI:R) but no attacker privileges (PR:N), making it viable through social engineering tactics like phishing emails containing malicious links.
Xagio SEO WordPress plugin through version 7.1.0.35 contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%), affecting authenticated users who can bypass intended access restrictions to modify plugin functionality or settings.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Cross-site request forgery in ThimPress WP Hotel Booking plugin version 2.2.8 and earlier allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction (clicking a malicious link) and results in limited information disclosure, with a CVSS score of 4.3. Exploitation probability is very low per EPSS (0.02% percentile 5%), suggesting this is a lower-priority vulnerability despite public researcher disclosure.
Server-Side Request Forgery in ThemesInflow Hercules Core plugin for WordPress allows authenticated, low-privilege attackers to forge server-side requests. Exploitation is complex and yields only limited confidentiality and integrity impact on internal services. No public exploit or active exploitation has been reported.
Missing authorization in the WP ERP plugin for WordPress versions up to 1.16.7 allows unauthenticated remote attackers to bypass access controls and modify data. The vulnerability has a CVSS 5.3 rating and only impacts integrity, with no confidentiality or availability loss. No active exploitation or public proof-of-concept is known, and the EPSS score is very low at 0.05%.
Improper access control in Metagauss EventPrime (WordPress event calendar plugin) up to version 4.2.4.1 allows authenticated, low-privileged users (e.g., subscriber) to modify limited event data without proper authorization checks. The vulnerability carries a medium CVSS 4.3 severity, with no confidentiality or availability impact, and an EPSS score of 0.05% indicating a very low exploitation probability. No public exploit or active exploitation (CISA KEV) has been observed.
Missing authorization in themezaa Litho Addons for WordPress (versions through 3.5) allows authenticated users to bypass access controls and gain unauthorized read/write access to sensitive data. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before exposing functionality. With an EPSS score of 0.04% and CVSS 5.4, exploitation requires valid authentication but no advanced attack complexity; this represents a moderate privilege escalation risk for multi-user WordPress installations.
Missing authorization controls in the Notification for Telegram WordPress plugin through version 3.5 allow authenticated users to modify notification settings they should not have access to, resulting in limited integrity impact. The vulnerability requires valid user credentials (PR:L in CVSS vector) and affects the plugin's access control enforcement rather than authentication bypass. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a low-probability real-world risk despite the authentication bypass tag.
Broken access control in the Gravitec.net Web Push Notifications WordPress plugin versions 2.9.17 and earlier allows authenticated users to modify push notification settings and content without proper authorization checks, enabling privilege escalation or manipulation of notifications intended for administrator-only configuration. The vulnerability requires valid WordPress user credentials but does not enforce role-based access controls on sensitive endpoints, granting low-privileged users unintended modification capabilities.
Ergonet Cache plugin versions up to 1.0.13 allows authenticated users to bypass access control checks and modify unauthorized data due to missing authorization validation. The vulnerability requires user authentication (PR:L) but has low real-world risk per EPSS (0.04%), though it can lead to unauthorized content modification in affected WordPress installations.
Cross-Site Request Forgery in the SMTP Mail WordPress plugin allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators if they are tricked into clicking a malicious link. The vulnerability affects versions up to and including 1.3.51 and can lead to unauthorized modification of plugin settings. There is no evidence of active exploitation or publicly available exploit code, and the EPSS probability of exploitation is very low (0.03%).
A Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Add Custom Codes (versions through 4.80) allows unauthenticated attackers, with no privileges, to trick a site administrator into executing unintended requests. Successful exploitation leads to high integrity impact—attackers can modify plugin settings, potentially injecting malicious content. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.03%).
Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).
Missing access control in ConveyThis WordPress plugin through version 269.2 allows authenticated users with low-level privileges to execute unauthorized actions with high confidentiality, integrity, and availability impact. The vulnerability stems from improper enforcement of authorization checks (CWE-862), enabling privilege escalation by exploiting misconfigured access control security levels. No public exploit identified at time of analysis, with EPSS score of 0.06% indicating low predicted exploitation probability.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
Cross-Site Request Forgery (CSRF) in the WordPress plugin 'Media Library File Download' (versions <= 1.4) allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as modifying download settings, potentially leading to unauthorized file download access. The vulnerability has a CVSS 3.1 base score of 4.3 (Low) with low integrity impact, and an EPSS score of 0.03% indicating negligible exploitation probability.
SQL injection in the WordPress plugin Image&Video FullScreen Background through version 1.6.7 allows authenticated attackers with low privileges to extract sensitive information from the database. The vulnerability has a high confidentiality impact but does not permit data modification. No public exploit or active exploitation has been reported, and the EPSS score of 0.05% indicates a low probability of real-world attacks.
Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.
Bertha AI WordPress plugin through version 1.13 allows unauthenticated attackers to modify content via incorrectly configured access control, enabling unauthorized changes to website data without authentication. The vulnerability stems from missing authorization checks on sensitive operations, classified as CWE-862 (Missing Authorization). While CVSS scores 5.3 (medium severity), EPSS exploitation probability is minimal at 0.04%, indicating low real-world attack likelihood despite the straightforward attack vector.
Cross-site request forgery (CSRF) in Create Posts & Terms WordPress plugin through version 1.3.1 enables attackers to inject malicious scripts that persist in the application database. Exploitation requires tricking an authenticated administrator into visiting a malicious page while logged into WordPress. The vulnerability chains CSRF with stored XSS, allowing attackers to execute arbitrary JavaScript in victims' browsers across sessions with potential for privilege escalation, data theft, and site compromise. EPSS score and exploitation data not available, but Patchstack database listing indicates security researcher disclosure.
Missing authorization vulnerability in Actionwear Products Sync plugin for WordPress up to 2.3.3 allows authenticated attackers with low privileges to disrupt product synchronization operations. The flaw stems from improperly configured access control levels, leading to availability impact. No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Unauthenticated information disclosure in the Hype WordPress plugin (versions <=1.0.5) arises from a missing authorization check, allowing remote attackers to access restricted data. No active exploitation or public exploit code is reported, and EPSS estimates a very low exploitation likelihood (0.05%), making this a low-priority issue for most organizations unless the exposed information is highly sensitive.
The 10Web Booster - Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.1321.
Stored Cross-Site Scripting in the Omnipress WordPress plugin (all versions through 1.6.3) allows authenticated attackers with Author-level privileges or higher to upload SVG files containing malicious JavaScript payloads, which execute in the browsers of any user who subsequently accesses the uploaded file. The root cause is insufficient sanitization of SVG file content at upload time and missing output escaping when the file is served, as confirmed by Wordfence and traced to FileUploader.php and FileUploadRestController.php. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.02% reflects minimal real-world exploitation probability.
Unauthenticated privilege escalation via password reset in the CRM Memberships plugin for WordPress (versions ≤2.5) lets remote attackers take over any user account. The `ntzcrm_changepassword` AJAX action lacks both authentication and authorization (nonce/capability) checks, so anyone who knows or enumerates a victim's email can set that account's password; a companion unauthenticated `ntzcrm_get_users` endpoint leaks subscriber emails to make targeting trivial. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the flaw is remotely triggerable with no user interaction.
The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages.
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Stored cross-site scripting (XSS) in the Arconix Shortcodes WordPress plugin allows authenticated attackers with at least contributor-level access to inject malicious scripts via shortcodes. When other users view the affected content, the injected JavaScript executes, leading to session hijacking, credential theft, or unauthorized actions. A publicly available proof-of-concept exploit exists, though EPSS indicates a low probability of widespread exploitation.
Permission bypass in Wbcom Designs lock-my-bp WordPress plugin through 2.1.1 allows unauthenticated attackers to modify plugin settings or data due to missing authorization checks. This vulnerability, classified as CWE-862 Missing Authorization, enables unauthorized integrity impact with no confidentiality or availability consequences. The low EPSS score (0.05%) indicates limited exploitation likelihood, and no active exploitation or public exploit code has been reported.
Missing authorization in the TrueBooker WordPress plugin allows unauthenticated attackers to remotely modify appointment booking data. The vulnerability affects versions up to and including 1.1.0 and is classified as CWE-862. No active exploitation or public exploit is known, and EPSS estimates a very low exploitation probability (0.05%).
Unauthorized data modification in the WP Email Capture plugin for WordPress up to version 3.12.4 allows unauthenticated attackers to alter email capture settings or data through missing authorization checks. The vulnerability has a CVSS base score of 5.3 with low integrity impact and no confidentiality or availability impact. No active exploitation or public proof-of-concept has been identified, and the vulnerability is considered low risk.
Unauthenticated integrity impact in Easy Form Builder plugin up to 3.8.20 allows remote attackers to modify form settings or data due to missing authorization checks. The vulnerability, classified as CWE-862 (Missing Authorization), poses a medium severity risk (CVSS 5.3) with low integrity impact. No active exploitation or public exploit code has been identified at this time.
Unauthenticated access to a restricted endpoint in the Sitewide Notice WP WordPress plugin (versions up to 2.4.1) allows attackers to exploit a missing authorization check, resulting in low-impact availability disruption. The vulnerability requires no credentials or user interaction, but the impact is limited to minor service degradation (e.g., toggling notice state). No public exploit code or active exploitation has been identified; EPSS indicates very low exploitation probability.
Missing authorization checks in wpdevart Booking Calendar WordPress plugin (versions ≤ 3.2.30) allow unauthenticated remote attackers to modify appointment booking data, resulting in low integrity impact. The vulnerability has a CVSS base score of 5.3, EPSS score 0.05% (16th percentile), and no known active exploitation or public exploit code.
Missing authorization in the Woffice Core WordPress plugin ≤5.4.30 allows unauthenticated remote attackers to cause limited denial-of-service (availability impact) by exploiting incorrectly configured access control. No confidentiality or integrity impact has been identified. EPSS indicates very low exploitation probability (0.05%) and no active exploitation or public exploit code is known.
Missing authorization in Post SMTP WordPress plugin (≤3.6.1) allows unauthenticated remote attackers to perform restricted administrative actions due to improperly enforced access control on one or more plugin endpoints. Reported by Patchstack and tracked as CWE-862, the flaw permits integrity-affecting operations without requiring any authentication or user interaction. No public exploit code exists and EPSS sits at 0.05% (16th percentile), indicating low observed exploitation interest at time of analysis.
Incorrectly configured access control in WebCodingPlace Image Caption Hover Pro allows authenticated attackers with low privileges to modify plugin data and disrupt service. The vulnerability affects all plugin versions prior to 20.0 and requires only a low-privilege account on the WordPress site. Exploitation probability is very low (EPSS 0.05%) and no active attacks are reported.
Privilege escalation through missing authorization in the WordPress Debug Log Viewer plugin (≤2.0.3) allows authenticated low-privilege users to view and modify debug logs, exposing sensitive data such as database credentials or error details. No active exploitation or public PoC is currently known, and the EPSS score is extremely low (0.03%).
Broken access control in the Listdom WordPress plugin up to version 5.0.1 allows authenticated low-privileged attackers to modify data and potentially disrupt service, as missing authorization checks can be exploited without user interaction. No active exploitation or public exploit has been reported at the time of analysis, and EPSS indicates a very low probability (0.05%) of exploitation.
Low-privilege WordPress users can modify booking data and disrupt scheduling in vcita Meeting Scheduler plugin versions up to 4.5.5 due to missing authorization checks. Exploitation requires an authenticated subscriber-level account but has no user interaction, allowing unauthorized integrity and availability impact. No active exploitation or public exploit code has been identified.
Stored cross-site scripting in the Rencontre WordPress plugin up to version 3.13.7 allows authenticated attackers with high privileges to inject malicious scripts into fields rendered on pages accessed by other users. Successful exploitation could lead to session hijacking, data exfiltration, or defacement when victims view the affected content. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting (XSS) in the Calendly Embedder WordPress plugin (versions ≤ 1.1.7.2) allows authenticated administrators to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability requires high privileges and user interaction, resulting in low confidentiality, integrity, and availability impact. No active exploitation or public exploit code is known, and EPSS indicates a 0.06% probability of exploitation.
Missing authorization in WP Delicious plugin versions up to 1.9.1 enables authenticated attackers with low privileges (e.g., subscriber) to modify data with high integrity impact. This WordPress plugin vulnerability (CWE-862) has a CVSS base score of 6.5, no confidentiality impact, and requires no user interaction. At this time, no public exploit code or active exploitation has been reported.
Stored cross-site scripting vulnerability in the WP-ShowHide WordPress plugin (versions through 1.05) allows authenticated attackers with contributor-level access to inject arbitrary web scripts. When a
We are tasked with synthesizing data about CVE-2025-67534 into a comprehensive JSON analysis. We must use ALL provided data: references, EPSS, KEV status (not mentioned, assume false), patch availability, CPE strings (none provided), and tags (CSRF, XSS). First, parse the description: "Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7." CVSS: 7.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CWE-352. EPSS: 0.03% (low). No KEV mentioned, so not actively exploited. No POC data. Patch? Reference is a Patchstack database entry for a WordPress plugin. We need to infer patch availability. The reference URL likely describes the vulnerability and might say if a patch exists. Since no explicit fix version is mentioned beyond "<= 3.13.7", it's probable that the next version after 3.13.7 is a fix, but not confirmed. I'll say "Patch availability not confirmed; likely fix in version >3.13.7" but careful: rule says "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". We don't have explicit patch data. I'll note: "Upstream fix not independently confirmed; likely version after 3.13.7 addresses the issue" but avoid inventing version numbers. For remediation, I can say "Upgrade to Rencontre version 3.13.8 or higher if available, or apply vendor-provided patch" but careful: we only know <= 3.13.7 affected, so fix version would be 3.13.8. Patchstack might indicate the fix version. Since the reference is a Patchstack URL, they usually show the fixed version. So I'll assume the fix is in a later version. I'll state: "Vendor patch likely available in version 3.13.8 or later" but the rule says to cite exact fix versions from input data. The input data doesn't mention a specific fix version, only "through <= 3.13.7". I'll check: "Patch available per vendor advisory" would fit if the advisory says patch available. The reference URL is
Stored cross-site scripting in the Themify Portfolio Post WordPress plugin through version 1.3.0 allows authenticated attackers to embed arbitrary web scripts into portfolio items, which execute in victims’ browsers upon viewing. This can enable session theft, credential capture, or malicious redirects. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low (0.06%).
Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.
Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.
Authenticated SQL injection in the Media Library Tools WordPress plugin (≤1.6.15) allows high-privilege attackers to extract sensitive database information, with CVSS 7.6 signaling high confidentiality impact but limited integrity impact; no active exploitation or public exploit code is known, and EPSS indicates very low exploitation probability (0.06%).
SQL injection in the Ninja Tables WordPress plugin (≤5.2.3) enables authenticated administrators to extract sensitive database contents. The flaw allows high-privileged users to perform unauthorized SQL queries, compromising confidentiality with limited availability impact. No active exploitation or public PoC has been reported, and EPSS indicates very low exploitation probability.
Blind SQL injection in LambertGroup Accordion Slider PRO WordPress plugin versions through 1.2 allows authenticated attackers to exfiltrate sensitive database information. An attacker with low-privilege access (such as a subscriber) can execute arbitrary SQL queries via vulnerable plugin parameters, potentially accessing all database contents. No public exploit code or active exploitation has been reported, though the vulnerability carries a high confidentiality impact.
Blind SQL injection in the ArtPlacer Widget WordPress plugin (versions through 2.22.9.2) allows an authenticated low-privilege attacker to extract database contents via crafted requests to a vulnerable endpoint. The vulnerability carries a scope-changed CVSS rating because the WordPress database is shared across plugins and core, meaning successful exploitation can expose credentials, user data, and content belonging to other installed components - not just the ArtPlacer plugin itself. No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score (0.06%, 19th percentile) reflects minimal current attacker interest.
A cross-site request forgery vulnerability in the CWW Companion WordPress plugin up to version 1.3.2 allows unauthenticated attackers to trick admin users into performing unintended actions, such as modifying plugin
Cross-site request forgery in vcita Online Booking & Scheduling Calendar plugin for WordPress versions <=4.5.5 enables an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as modifying calendar settings, due to missing CSRF token validation. No known active exploitation or public exploit code exists; EPSS predicts very low exploitation likelihood (0.03%).
Cross-Site Request Forgery in the Quick Contact Form WordPress plugin through version 8.2.5 allows unauthenticated attackers to trick authenticated administrators into performing unintended actions, such as modifying form settings. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world exploitation.
Cross-site request forgery (CSRF) in the kubiq PDF Thumbnail Generator WordPress plugin (versions through 1.4) allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Successful exploitation requires user interaction, such as tricking an admin to click a link, and could result in limited integrity impact, like altering plugin settings. No public exploit code or active exploitation has been reported; EPSS indicates a very low exploitation probability.
Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.
Cross-site request forgery in GiveWP plugin through version 4.13.1 allows remote attackers to trick authenticated administrators into performing unauthorized actions, such as tampering with donation settings. The vulnerability requires user interaction and has a medium CVSS score of 5.4, with no active exploitation or public proof-of-concept identified. EPSS probability is very low at 0.02%.
Missing authorization in the Trinity Audio WordPress plugin up to version 5.23.3 allows authenticated attackers with low privileges to modify plugin data without the required capabilities, leading to potential integrity issues on affected sites. The vulnerability has a medium CVSS score of 4.3 and a very low EPSS exploitation probability (0.05%), with no evidence of active exploitation or public exploit code at this time.
Cross-site request forgery (CSRF) vulnerability in the Simple Link Directory WordPress plugin allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying or deleting link directory entries. Affects versions up to and including 8.8.3. No active exploitation or public exploit has been reported, and the EPSS score is low (0.03%).
Arbitrary shortcode execution in GiveWP plugin for WordPress up to version 4.13.1 allows unauthenticated remote attackers to inject and execute arbitrary shortcodes, potentially leading to information disclosure or full code execution depending on the site's installed shortcodes. The vulnerability is categorized as code injection (CWE-94) with a CVSS base score of 5.3, reflecting only confidentiality impact in the official scoring, though advisory tags suggest RCE capability. No active exploitation or public exploit code is known, and EPSS predicts a very low 0.04% exploitation probability.
Cross-site request forgery in the Salon booking system plugin for WordPress (versions up to 10.30.3) allows remote attackers to perform unauthorized actions on behalf of authenticated users, such as modifying settings or deleting bookings. Exploitation requires tricking a logged-in administrator into clicking a malicious link; no public exploit code or active exploitation has been identified at this time. EPSS score is 0.03%, indicating very low probability of widespread exploitation.
Insufficient access controls in Webba Booking plugin for WordPress (versions up to 6.2.1) allow authenticated attackers with low privileges to modify booking data. EPSS score is low, and no active exploitation is reported.
Cross-site request forgery in Ays Pro Chartify plugin for WordPress through version 3.6.3 allows an attacker to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a malicious link. No active exploitation or public exploit code has been identified at this time, and the exploitation probability is low (EPSS 0.03%). The vulnerability could lead to modification of chart builder settings but cannot compromise confidentiality or availability.
An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.
Information disclosure in the My Tickets WordPress plugin through 2.1.0 allows authenticated attackers with low privileges to access sensitive data via a missing authorization check. The vulnerability has a CVSS base score of 4.3, low EPSS exploitation probability (0.05%), and is not listed in CISA KEV nor associated with public exploit code.
Cross-Site Request Forgery in PressTigers Simple Folio WordPress plugin up to version 1.1.0 allows an unauthenticated remote attacker to trick an administrator into performing unintended state-changing actions, such as modifying plugin settings, resulting in low integrity impact. User interaction is required to exploit this vulnerability; no confidentiality or availability impact occurs. At the time of analysis, no active exploitation or public exploit code has been identified, and the EPSS score is very low (0.03%), indicating low likelihood of widespread attacks.
Missing authorization in the Admin and Site Enhancements (ASE) WordPress plugin up to version 8.0.8 allows authenticated high-privilege attackers to make low-impact modifications without proper access controls. With a CVSS score of 2.7, EPSS 0.07%, and no known active exploitation or public exploit, the risk is low for most environments.
Missing authorization in the Photo Block WordPress plugin allows authenticated users with high privileges (administrator) to exploit improperly configured access control to modify data they should not have access to, resulting in a low integrity impact. The vulnerability affects all plugin versions up to and including 1.5.1, with no confidentiality or availability compromise. No active exploitation or public exploit code is known at the time of analysis, and EPSS assigns a minimal exploitation probability of 0.07%.
Happy Addons for Elementor through version 3.20.3 allows authenticated users to access functionality they should not have permission to use due to missing authorization checks on API endpoints or admin functions. The vulnerability requires valid user authentication and results in information disclosure, with a CVSS score of 4.3 and an extremely low EPSS exploitation probability of 0.04%, suggesting minimal real-world attack incentive despite the access control flaw.
Porto Theme - Functionality plugin for WordPress (versions before 3.7.3) allows authenticated users to access sensitive information through broken access control, enabling privilege escalation or information disclosure without proper authorization checks. While the vulnerability requires valid WordPress credentials and has low CVSS severity (4.3), the confirmed patch availability and authentication requirement reduce immediate risk. No public exploit code or active exploitation has been identified at the time of analysis.
Media Library Assistant WordPress plugin through version 3.29 allows authenticated users to bypass authorization controls and access or modify content they should not have permission to reach via user-controlled keys in access control mechanisms. The vulnerability requires an authenticated user with limited privileges (PR:L) and affects confidentiality and integrity of stored media library data, though with relatively low exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.
Unauthorized information disclosure in the Yandex.Metrica WordPress plugin (versions up to 1.2.2) allows unauthenticated attackers to access sensitive data via missing authorization checks. No public exploit code or active exploitation has been identified at this time; the EPSS probability of exploitation is very low (0.05%).
Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.
Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.
DOM-based cross-site scripting in WordPress plugin WP Ultimate Review versions ≤2.3.7 allows remote attackers to execute malicious JavaScript in victims' browsers via crafted input that is improperly sanitized during client-side page rendering. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering or malicious links. Exploitation probability is low (EPSS 0.04%, 14th percentile), with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Authenticated users can access sensitive contact form data and functionality they should not have permission to view or modify due to missing authorization checks in Contact Form by BestWebSoft plugin versions up to 4.3.6. The vulnerability allows logged-in attackers with low-level privileges to bypass access controls and view contact information or modify form settings with only network access and no additional user interaction required. This is not actively exploited according to available intelligence, though the access control bypass pattern is a common attack vector.
Missing authorization in ExpressTech Systems Quiz And Survey Master WordPress plugin through version 10.3.2 allows unauthenticated remote attackers to read sensitive quiz and survey data by exploiting incorrectly configured access control security levels. The vulnerability is assigned CVSS 5.3 (moderate), affects the plugin across multiple versions, and enables unauthorized information disclosure without requiring authentication or user interaction.
Stored cross-site scripting in the REHub Framework WordPress plugin versions below 19.9.9.7 permits authenticated attackers to inject malicious scripts. When a victim, such as an administrator, views the tainted content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability has a low EPSS score (0.06%) and no public exploit or reported active exploitation.
Missing authorization in ListingPro Lead Form plugin for WordPress enables unauthenticated attackers to modify lead data due to improper access controls. Affects versions up to 1.0.7. No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.05% indicates low current exploitation probability, though the remote unauthenticated nature makes the vulnerability easily exploitable if targeted.
DOM-based Cross-Site Scripting in the CridioStudio ListingPro Lead Form plugin for WordPress allows authenticated attackers with low privileges to inject arbitrary JavaScript into pages viewed by other users. Exploitation requires the attacker to submit crafted input via the vulnerable lead form and convince a victim to visit a page where the tainted data is rendered unsafely, enabling session hijacking, phishing, or browser-based attacks. No active exploitation or public exploit code has been identified.
A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.
A missing authorization check in the Steve Truman Page View Count WordPress plugin (≤ 2.9.0) allows authenticated attackers with low privileges to modify plugin settings without appropriate access controls. This can lead to limited integrity and availability impacts, such as disrupting plugin functionality or altering its behavior. The vulnerability has a low EPSS exploitation probability (0.05%) and is not known to be actively exploited in the wild.
Stored XSS in Make Section & Column Clickable For Elementor WordPress plugin (versions through 2.4) allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects site confidentiality, integrity, and availability with limited scope. EPSS score of 0.04% indicates low exploitation probability despite the presence of a public vulnerability disclosure.
Cross-Site Request Forgery in WordPress New User Approve plugin (versions ≤3.2.3) enables unauthenticated remote attackers to trick authenticated administrators into executing unauthorized actions via crafted requests. With EPSS probability of 0.02% (5th percentile) and no evidence of active exploitation (not in CISA KEV), this represents a moderate real-world risk despite a CVSS 7.1 score. The vulnerability requires user interaction (UI:R) but no attacker privileges (PR:N), making it viable through social engineering tactics like phishing emails containing malicious links.
Xagio SEO WordPress plugin through version 7.1.0.35 contains a missing authorization vulnerability that allows authenticated users to perform unauthorized actions due to incorrectly configured access control security levels. The vulnerability has a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%), affecting authenticated users who can bypass intended access restrictions to modify plugin functionality or settings.
Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.
Cross-site request forgery in ThimPress WP Hotel Booking plugin version 2.2.8 and earlier allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction (clicking a malicious link) and results in limited information disclosure, with a CVSS score of 4.3. Exploitation probability is very low per EPSS (0.02% percentile 5%), suggesting this is a lower-priority vulnerability despite public researcher disclosure.
Server-Side Request Forgery in ThemesInflow Hercules Core plugin for WordPress allows authenticated, low-privilege attackers to forge server-side requests. Exploitation is complex and yields only limited confidentiality and integrity impact on internal services. No public exploit or active exploitation has been reported.
Missing authorization in the WP ERP plugin for WordPress versions up to 1.16.7 allows unauthenticated remote attackers to bypass access controls and modify data. The vulnerability has a CVSS 5.3 rating and only impacts integrity, with no confidentiality or availability loss. No active exploitation or public proof-of-concept is known, and the EPSS score is very low at 0.05%.
Improper access control in Metagauss EventPrime (WordPress event calendar plugin) up to version 4.2.4.1 allows authenticated, low-privileged users (e.g., subscriber) to modify limited event data without proper authorization checks. The vulnerability carries a medium CVSS 4.3 severity, with no confidentiality or availability impact, and an EPSS score of 0.05% indicating a very low exploitation probability. No public exploit or active exploitation (CISA KEV) has been observed.
Missing authorization in themezaa Litho Addons for WordPress (versions through 3.5) allows authenticated users to bypass access controls and gain unauthorized read/write access to sensitive data. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before exposing functionality. With an EPSS score of 0.04% and CVSS 5.4, exploitation requires valid authentication but no advanced attack complexity; this represents a moderate privilege escalation risk for multi-user WordPress installations.
Missing authorization controls in the Notification for Telegram WordPress plugin through version 3.5 allow authenticated users to modify notification settings they should not have access to, resulting in limited integrity impact. The vulnerability requires valid user credentials (PR:L in CVSS vector) and affects the plugin's access control enforcement rather than authentication bypass. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a low-probability real-world risk despite the authentication bypass tag.
Broken access control in the Gravitec.net Web Push Notifications WordPress plugin versions 2.9.17 and earlier allows authenticated users to modify push notification settings and content without proper authorization checks, enabling privilege escalation or manipulation of notifications intended for administrator-only configuration. The vulnerability requires valid WordPress user credentials but does not enforce role-based access controls on sensitive endpoints, granting low-privileged users unintended modification capabilities.
Ergonet Cache plugin versions up to 1.0.13 allows authenticated users to bypass access control checks and modify unauthorized data due to missing authorization validation. The vulnerability requires user authentication (PR:L) but has low real-world risk per EPSS (0.04%), though it can lead to unauthorized content modification in affected WordPress installations.
Cross-Site Request Forgery in the SMTP Mail WordPress plugin allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators if they are tricked into clicking a malicious link. The vulnerability affects versions up to and including 1.3.51 and can lead to unauthorized modification of plugin settings. There is no evidence of active exploitation or publicly available exploit code, and the EPSS probability of exploitation is very low (0.03%).
A Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Add Custom Codes (versions through 4.80) allows unauthenticated attackers, with no privileges, to trick a site administrator into executing unintended requests. Successful exploitation leads to high integrity impact—attackers can modify plugin settings, potentially injecting malicious content. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.03%).
Missing authorization in the Quick Interest Slider WordPress plugin (≤ 3.1.7) allows unauthenticated attackers to modify slider configuration data over the network. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.07%).
Missing access control in ConveyThis WordPress plugin through version 269.2 allows authenticated users with low-level privileges to execute unauthorized actions with high confidentiality, integrity, and availability impact. The vulnerability stems from improper enforcement of authorization checks (CWE-862), enabling privilege escalation by exploiting misconfigured access control security levels. No public exploit identified at time of analysis, with EPSS score of 0.06% indicating low predicted exploitation probability.
Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.
Cross-Site Request Forgery (CSRF) in the WordPress plugin 'Media Library File Download' (versions <= 1.4) allows an unauthenticated attacker to trick a logged-in administrator into performing actions such as modifying download settings, potentially leading to unauthorized file download access. The vulnerability has a CVSS 3.1 base score of 4.3 (Low) with low integrity impact, and an EPSS score of 0.03% indicating negligible exploitation probability.
SQL injection in the WordPress plugin Image&Video FullScreen Background through version 1.6.7 allows authenticated attackers with low privileges to extract sensitive information from the database. The vulnerability has a high confidentiality impact but does not permit data modification. No public exploit or active exploitation has been reported, and the EPSS score of 0.05% indicates a low probability of real-world attacks.
Missing authorization in Яндекс Доставка (Boxberry) WordPress plugin version 2.34 and earlier allows authenticated users to access or modify resources they should not be permitted to via incorrectly configured access control. An attacker with valid credentials can exploit broken access control mechanisms to view or modify sensitive data without proper privilege validation, though the CVSS 5.4 score reflects limited direct impact (confidentiality and integrity), and the 0.04% EPSS score indicates low real-world exploitation probability.
Bertha AI WordPress plugin through version 1.13 allows unauthenticated attackers to modify content via incorrectly configured access control, enabling unauthorized changes to website data without authentication. The vulnerability stems from missing authorization checks on sensitive operations, classified as CWE-862 (Missing Authorization). While CVSS scores 5.3 (medium severity), EPSS exploitation probability is minimal at 0.04%, indicating low real-world attack likelihood despite the straightforward attack vector.
Cross-site request forgery (CSRF) in Create Posts & Terms WordPress plugin through version 1.3.1 enables attackers to inject malicious scripts that persist in the application database. Exploitation requires tricking an authenticated administrator into visiting a malicious page while logged into WordPress. The vulnerability chains CSRF with stored XSS, allowing attackers to execute arbitrary JavaScript in victims' browsers across sessions with potential for privilege escalation, data theft, and site compromise. EPSS score and exploitation data not available, but Patchstack database listing indicates security researcher disclosure.
Missing authorization vulnerability in Actionwear Products Sync plugin for WordPress up to 2.3.3 allows authenticated attackers with low privileges to disrupt product synchronization operations. The flaw stems from improperly configured access control levels, leading to availability impact. No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Unauthenticated information disclosure in the Hype WordPress plugin (versions <=1.0.5) arises from a missing authorization check, allowing remote attackers to access restricted data. No active exploitation or public exploit code is reported, and EPSS estimates a very low exploitation likelihood (0.05%), making this a low-priority issue for most organizations unless the exposed information is highly sensitive.
The 10Web Booster - Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.1321.
Stored Cross-Site Scripting in the Omnipress WordPress plugin (all versions through 1.6.3) allows authenticated attackers with Author-level privileges or higher to upload SVG files containing malicious JavaScript payloads, which execute in the browsers of any user who subsequently accesses the uploaded file. The root cause is insufficient sanitization of SVG file content at upload time and missing output escaping when the file is served, as confirmed by Wordfence and traced to FileUploader.php and FileUploadRestController.php. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.02% reflects minimal real-world exploitation probability.
Unauthenticated privilege escalation via password reset in the CRM Memberships plugin for WordPress (versions ≤2.5) lets remote attackers take over any user account. The `ntzcrm_changepassword` AJAX action lacks both authentication and authorization (nonce/capability) checks, so anyone who knows or enumerates a victim's email can set that account's password; a companion unauthenticated `ntzcrm_get_users` endpoint leaks subscriber emails to make targeting trivial. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the flaw is remotely triggerable with no user interaction.
The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages.
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
The Beaver Builder - WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Stored cross-site scripting (XSS) in the Arconix Shortcodes WordPress plugin allows authenticated attackers with at least contributor-level access to inject malicious scripts via shortcodes. When other users view the affected content, the injected JavaScript executes, leading to session hijacking, credential theft, or unauthorized actions. A publicly available proof-of-concept exploit exists, though EPSS indicates a low probability of widespread exploitation.