Wordpress Plugin
Monthly
Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.
Unauthenticated access control bypass in Blog Designer PRO WordPress plugin (versions through 3.4.8) allows remote attackers to invoke ACL-restricted functionality without holding any WordPress account, resulting in limited unauthorized data modification. The provided CVSS vector confirms the attack is network-accessible with no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), though impact is bounded to integrity-only modifications with no confidentiality or availability consequence. No public exploit has been identified and EPSS places this at the 18th percentile (0.06%), indicating no observed mass exploitation - this vulnerability is also absent from CISA KEV.
Cross-site request forgery in Ays Pro Popup box WordPress plugin versions up to 5.5.4 allows attackers to perform unauthorized actions (such as modifying plugin settings or creating popups) on behalf of authenticated administrators without their knowledge or consent. The vulnerability requires victim interaction (clicking a malicious link while logged in) but carries low exploitation probability (EPSS 0.02%, percentile 4%), suggesting limited real-world attack pressure despite the theoretical risk.
Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).
Server-Side Request Forgery in the Codeless Slider Templates WordPress plugin (versions ≤1.0.3) enables authenticated low-privilege users to induce the server to make arbitrary outbound HTTP requests, potentially reaching internal network resources such as cloud metadata services or private APIs. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:L/I:L) confirms network exploitation requires an authenticated WordPress account and high attack complexity, with scope change indicating cross-boundary impact on internal infrastructure. No active exploitation is confirmed - EPSS sits at 0.03% (10th percentile) and no KEV listing exists - placing this firmly in the low real-world priority tier despite the scope change.
Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.
The KiotViet Sync WordPress plugin through version 1.8.5 exposes restricted administrative functions to low-privileged authenticated users due to missing authorization checks (CWE-862), allowing unauthorized data modification via the plugin's sync operations. The flaw is network-exploitable with low privilege requirements and no user interaction, though impact is limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating very low exploitation probability despite the broken access control classification.
Missing authorization controls in the Baidu SEO Collection WordPress plugin versions up to 2.1.4 allow unauthenticated remote attackers to access restricted functionality and retrieve sensitive information without proper permission checks. The vulnerability affects the plugin's core access control mechanisms, enabling unauthorized information disclosure with a CVSS score of 5.3. EPSS exploitation probability is low at 0.03%, and no active exploitation has been confirmed.
Broken access control in the Sendle Shipping WordPress plugin (official-sendle-shipping-method) versions through 6.02 allows unauthenticated remote attackers to invoke plugin functionality that should be restricted to authorized users. The flaw stems from missing authorization checks (CWE-862), meaning certain shipping-related actions are accessible without any privilege verification. Real-world impact is limited to availability disruption (CVSS A:L), with no confidentiality or integrity impact identified. No public exploit code exists and EPSS places exploitation probability at 0.04% (11th percentile), indicating negligible active threat at time of analysis.
Cross-site request forgery in the Raychat WordPress plugin (versions through 2.2.1) enables an unauthenticated attacker to induce unauthorized state-changing actions on behalf of an authenticated user without their knowledge. The attack is constrained by a mandatory user-interaction requirement - a victim with an active authenticated session must visit a malicious page. EPSS at 0.02% (5th percentile) confirms negligible exploitation probability, and no public exploit or CISA KEV listing has been identified at time of analysis.
Missing authorization checks in WebinarPress (wp-webinarsystem) WordPress plugin version 1.33.28 and earlier allow authenticated low-privileged users to perform availability-impacting actions beyond their intended access level. The flaw stems from incorrectly configured access control security levels (CWE-862), enabling a WordPress subscriber-tier user to invoke plugin functionality restricted to higher roles. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS probability stands at 0.03%, indicating low real-world exploitation interest currently.
Link Whisper Free WordPress plugin through version 0.9.2 allows unauthenticated remote attackers to read sensitive information via missing authorization checks on API endpoints. The vulnerability enables bypassing access controls to retrieve data that should be restricted, confirmed with CVSS 5.3 and EPSS 0.03% exploitation probability. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.
Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.
Broken access control in RealMag777 MDTF (WordPress Meta Data Filter and Taxonomy Filter) plugin versions up to 1.3.6 allows low-privileged authenticated users to bypass authorization controls and access or modify sensitive metadata and taxonomy filter configurations. While rated CVSS 8.1 (High), real-world exploitation risk remains moderate with EPSS at 0.03% (9th percentile) and no confirmed active exploitation or public exploit code identified at time of analysis. This authentication bypass vulnerability was disclosed by Patchstack's security audit team.
DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.
Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.
Cross-Site Request Forgery in the Simple Content Templates WordPress plugin ≤2.2.61 allows unauthenticated attackers to trick logged-in administrators into performing unauthorized actions with low integrity impact. Exploitation requires victim interaction via a crafted link and has no known active exploitation or public exploit, while EPSS indicates a very low (0.02%) probability of widespread exploitation.
CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.
Broken access control in Revive Old Posts (tweet-old-post) WordPress plugin through version 9.3.3 allows authenticated attackers with low-level privileges to escalate permissions and execute high-impact operations including data exfiltration, modification, and service disruption. EPSS score of 0.05% (15th percentile) indicates low probability of mass exploitation, though the 8.8 CVSS score reflects significant potential damage once low-privilege access is obtained. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.
Broken access control in QuantumCloud ChatBot plugin for WordPress through version 7.7.3 allows authenticated attackers with low privileges to exploit misconfigured authorization checks, potentially leading to high-impact data breaches, unauthorized modifications, and service disruption. EPSS scoring indicates low exploitation probability (0.05%, 15th percentile), and no public exploit identified at time of analysis. The vulnerability stems from missing authorization controls (CWE-862), requiring only network access and low-privilege credentials with no user interaction, making it readily exploitable once an account is compromised.
Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.
Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.
An unauthenticated attacker can exploit missing authorization checks in the Everest Backup WordPress plugin (<=2.3.8) to trigger resource-intensive backup operations without any privileges, causing a low impact on server availability. No active exploitation or public proof-of-concept is known, and the EPSS score is very low (0.06%).
Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.
Unauthenticated access to CSV export data in the MSTW CSV EXPORTER plugin for WordPress versions up to 1.4 allows an attacker to retrieve exported information without any authentication. The issue arises from a missing authorization check on a publicly accessible export endpoint. No active exploitation or public exploit code is known, and the EPSS score of 0.06% indicates a very low probability of widespread exploitation.
Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.
Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.
Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.
Missing authorization in Reoon Email Verifier for WordPress allows authenticated users to exploit incorrectly configured access control, potentially causing low-impact service disruption. Affected versions up to 2.0.1 are vulnerable. No active exploitation or public exploit code is known, and EPSS indicates a 0.04% exploitation probability.
Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.
WordPress Table Block by RioVizual plugin versions through 3.0.0 contains a broken access control vulnerability allowing authenticated attackers with low privileges to bypass authorization checks and perform high-impact actions including data theft, modification, and service disruption. The CVSS score of 8.8 reflects network-accessible exploitation with low complexity requiring only minimal authentication. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, with no public exploit identified at time of analysis.
Broken access control in MSN Partner Hub WordPress plugin allows authenticated attackers with low privileges to bypass authorization controls and gain unauthorized access to high-privilege functions. This CWE-862 missing authorization flaw affects versions through 2.9, enabling authenticated users to execute actions beyond their intended permission level. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.
Unauthorized data access in PickPlugins Testimonial Slider for WordPress (≤2.0.15) enables low-privilege authenticated users to retrieve testimonials without proper authorization, leading to a confidentiality breach. The vulnerability allows any logged-in subscriber to read all testimonial entries, potentially exposing sensitive content. No active exploitation or public proof-of-concept is currently known.
An access control vulnerability in the SEO Meta Description Updater WordPress plugin (versions ≤1.2.0) allows low-privileged authenticated users to modify plugin settings without proper authorization. This missing authorization flaw (CWE-862) can be exploited over the network without user interaction, leading to unauthorized manipulation of SEO meta descriptions. No public exploit or active exploitation has been identified.
Confidential data exposure via missing authorization in Nelio Content WordPress plugin versions up to 4.0.5 allows authenticated low-privileged users (e.g., subscribers) to access information restricted to editors or administrators. The flaw carries a CVSS 6.5 score, but EPSS indicates very low exploitation probability (0.04%), and no public exploit or active exploitation has been identified.
Authenticated information disclosure in PickPlugins Post Grid and Gutenberg Blocks plugin for WordPress (≤2.3.17) allows low-privileged users to access sensitive post data due to missing authorization checks. The vulnerability requires a valid WordPress account with at least subscriber-level privileges but no user interaction. No public exploit code or active exploitation has been observed, and EPSS indicates a low probability of widespread exploitation (0.09%).
DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.
Unauthorized information disclosure in Export Categories plugin for WordPress through version 1.0 allows unauthenticated attackers to access category data due to a missing authorization check (CWE-862). Only category information is exposed, with no integrity or availability impact. The vulnerability has a low CVSS base score of 5.3, very low EPSS exploitation probability (0.04%), and no reports of active exploitation or public proof-of-concept.
Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.
Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.
Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.
Stored cross-site scripting in the Tooltipy (bluet-keywords-tooltip-generator) WordPress plugin through version 5.5.9 allows an authenticated attacker with low privileges to inject persistent malicious scripts into keyword tooltip data. When any site visitor views a page rendering the poisoned tooltip, the script executes in their browser under the site's origin, enabling session hijacking, credential theft, or further client-side attacks. No public exploit or active exploitation has been identified; EPSS is 0.02%, reflecting minimal current threat actor interest.
Broken access control in WP Flights & Hotels Booking WP Plugin (adiaha-hotel) versions ≤3.1 allows authenticated users with low privileges to bypass authorization checks and gain unauthorized access to high-impact functionality. Attackers can achieve complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization in Clicksend CF7 Plugin for WordPress versions ≤1.4.0 allows authenticated attackers to modify SMS notification settings without proper capability checks. The vulnerability has a low CVSS score of 4.3, no known public exploit, and an EPSS score of 0.06% indicating very low exploitation probability.
Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.
Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.
Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.
We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz
Missing authorization in Smart WeTransfer WordPress plugin up to version 1.3 allows authenticated users with low privileges to trigger actions that degrade service availability. The vulnerability is not known to be actively exploited, and EPSS indicates a low 0.04% probability of exploitation.
Stored cross-site scripting (XSS) in the WordPress plugin Custom Post Type Attachment (custom-post-type-pdf-attachment) up to version 3.4.6 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to session hijacking, defacement, or redirection to malicious sites. No active exploitation or public exploit code has been reported, but the vulnerability requires user interaction to trigger.
An access control weakness in Referral Link Tracker for WordPress up to 1.1.4 allows authenticated users with minimal privileges to interact with restricted plugin functionality, leading to limited availability impact. No data exposure or integrity tampering is indicated, and there is no evidence of active exploitation or public exploit code.
Stored cross-site scripting in the Query Posts WordPress plugin 0.3.2 and below allows an authenticated attacker with low privileges to inject malicious scripts that execute in the browser of users who view the affected page, leading to data theft or session hijacking. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Stored cross-site scripting in WordPress WP Geo plugin through version 3.5.1 enables authenticated attackers to inject malicious scripts that execute in victims' browsers. The vulnerability, reported by Patchstack, could allow session theft or content manipulation when a privileged user views a page containing the stored payload. No evidence of active exploitation exists, and the EPSS score is low (0.02%).
Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).
Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.
Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Stored cross-site scripting in the WordPress Links shortcode plugin up to version 1.8.3 allows authenticated attackers with low privileges to inject malicious scripts via the plugin's shortcode functionality. When a victim views a page containing the crafted shortcode, the injected script executes in their browser, leading to potential session theft, content manipulation, or redirection. No active exploitation or public exploit is reported, and EPSS indicates a low exploitation probability.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.
Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Stored Cross-Site Scripting vulnerability in ACF Recent Posts Widget WordPress plugin allows authenticated users with contributor-level access to inject malicious scripts into pages. Affects versions up to 5.9.3. EPSS score is very low (0.02%) and no public exploit or KEV listing identified, reducing immediate exploitation risk.
Unauthorized access to restricted functionality in Sunshine Photo Cart plugin for WordPress allows unauthenticated attackers to perform unauthorized actions. The vulnerability affects all versions up to and including 3.5.3, and stems from missing authorization checks that enable attackers to access functionality not properly constrained by Access Control Lists. With a low EPSS score (0.04%) and no reported active exploitation, the real-world risk is limited, though the flaw has a CVSS 5.3 medium rating.
Cross-site request forgery in the Off-Canvas Sidebars plugin for WordPress (≤0.5.8.5) allows unauthenticated attackers to trick administrators into modifying sidebar settings via a crafted link. Successful exploitation requires user interaction and leads to limited integrity impact with no confidentiality or availability consequences. No evidence of active exploitation or public exploit code exists at this time.
Broken access control in King Addons for Elementor (WordPress plugin) versions through 51.1.61 allows authenticated attackers with low privileges to bypass authorization checks and gain unauthorized access to high-privilege functionality. The CVSS 8.8 score reflects potential for full compromise (high confidentiality, integrity, and availability impact), though the EPSS score of 0.05% (15th percentile) indicates minimal real-world exploitation observed. No public exploit code or CISA KEV listing identified at time of analysis. The vulnerability stems from improperly configured access control security levels (CWE-862: Missing Authorization), enabling privilege escalation by low-privileged users.
DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.
Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.
Missing authorization in RelyWP Coupon Affiliates plugin (versions up to 7.2.0) allows unauthenticated remote attackers to access restricted functionality and read sensitive data due to inadequate access control list (ACL) enforcement. The vulnerability requires no authentication and has low attack complexity, enabling attackers to bypass WordPress permission checks and retrieve coupon-related information not intended for public access.
Authenticated low-privilege users of the Seriously Simple Podcasting WordPress plugin (version ≤ 3.13.0) can bypass access controls to modify podcast content. This missing authorization flaw (CWE-862) results from incorrectly configured access control security levels. Exploitation has not been observed in the wild (EPSS 0.03%).
Missing authorization checks in WP-Lister Lite for eBay 3.8.3 and earlier allow low-privileged authenticated attackers to modify plugin data. The vulnerability has a CVSS base score of 4.3 and an EPSS score of 0.03%, indicating low exploitation probability; no active exploitation is currently known.
Unauthorized data modification in Sovlix MeetingHub WordPress plugin through version 1.23.9 lets authenticated low-privilege attackers bypass authorization checks and alter meeting information. No active exploitation or public exploit is known; EPSS probability is 0.03%.
Missing authorization in the Front End Users WordPress plugin (≤3.2.33) allows authenticated attackers with low privileges to modify user data without proper access controls. The flaw stems from insufficient capability checks for certain actions, enabling unauthorized integrity impact with no confidentiality or availability loss. The vulnerability has a low EPSS score and no evidence of active exploitation or public exploits.
Missing authorization checks in the Repuso Social Proof Testimonials and Reviews widget for WordPress (<=5.29) allow authenticated attackers with low privileges to disrupt service availability. Exploitation probability is very low (EPSS 0.03%) and no active exploitation or public exploit code is known at this time.
Missing authorization checks in WPXPO WowRevenue 1.2.13 and earlier allow authenticated attackers with minimal privileges to modify plugin settings without proper capability checks, leading to limited integrity impact. This affects WordPress sites running the plugin and can be exploited remotely without user interaction.
Sensitive data exposure in ThemeRuby Easy Post Submission plugin for WordPress (<=1.7.0) allows authenticated administrators to retrieve embedded sensitive information from outbound data transmissions. The flaw leverages CWE-201 to leak low-impact confidentiality, integrity, and availability with high attack complexity and changed scope. No active exploitation or public exploit exists; EPSS probability is very low (0.04%).
Cross-site request forgery in the Product Catalog Simple WordPress plugin (versions ≤1.8.4) allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, potentially modifying catalog settings. The vulnerability has an extremely low EPSS exploitation probability (0.01%) and no known public exploit or active exploitation (not listed in CISA KEV).
An authenticated low-privilege user in WordPress with the One Page Express Companion plugin (versions ≤ 1.6.43) can exploit a missing authorization check to modify certain plugin data, leading to limited integrity impact. There is no known public exploit or active exploitation at this time.
Remote code execution in the s2Member WordPress plugin (≤ version 250905) allows unauthenticated attackers to inject and execute arbitrary PHP code, potentially leading to full site compromise. The vulnerability has a CVSS score of 9.0 but a very low EPSS exploitation probability (0.06%) and is not listed in CISA KEV; no public exploit is known at the time of analysis.
Unauthenticated access to sensitive data in BuddyPress up to version 14.3.4 allows remote attackers to read confidential information due to a missing authorization check. This vulnerability affects the popular WordPress social networking plugin and can be exploited without user interaction. Public exploit code is not known to exist, and EPSS indicates a very low probability (0.04%) of active exploitation.
Missing authorization in the Acknowledgify WordPress plugin (≤1.1.3) allows low-privilege authenticated users to modify plugin data without proper capability checks. The vulnerability, classified as CWE-862, carries a CVSS 3.1 base score of 4.3 (Medium) with low attack complexity and no user interaction. No public exploit or active exploitation has been reported, and EPSS assesses a 0.03% probability of exploitation.
WordPress UiChemy plugin up to 4.0.0 allows authenticated users with low privileges to modify plugin settings due to a missing authorization check. This could lead to unauthorized changes to plugin configuration. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of exploitation.
Cross-Site Request Forgery in the Super Store Finder WordPress plugin (versions through 7.5) enables remote unauthenticated attackers to perform unauthorized state-changing actions by forging requests on behalf of authenticated users. The plugin fails to implement WordPress nonce validation on one or more sensitive endpoints, meaning a logged-in administrator tricked into visiting a malicious page can have plugin data or settings modified without consent. With an EPSS of 0.02% (4th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a genuine but low-urgency finding appropriate for routine patch cycles.
Unauthenticated access control bypass in Blog Designer PRO WordPress plugin (versions through 3.4.8) allows remote attackers to invoke ACL-restricted functionality without holding any WordPress account, resulting in limited unauthorized data modification. The provided CVSS vector confirms the attack is network-accessible with no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), though impact is bounded to integrity-only modifications with no confidentiality or availability consequence. No public exploit has been identified and EPSS places this at the 18th percentile (0.06%), indicating no observed mass exploitation - this vulnerability is also absent from CISA KEV.
Cross-site request forgery in Ays Pro Popup box WordPress plugin versions up to 5.5.4 allows attackers to perform unauthorized actions (such as modifying plugin settings or creating popups) on behalf of authenticated administrators without their knowledge or consent. The vulnerability requires victim interaction (clicking a malicious link while logged in) but carries low exploitation probability (EPSS 0.02%, percentile 4%), suggesting limited real-world attack pressure despite the theoretical risk.
Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).
Server-Side Request Forgery in the Codeless Slider Templates WordPress plugin (versions ≤1.0.3) enables authenticated low-privilege users to induce the server to make arbitrary outbound HTTP requests, potentially reaching internal network resources such as cloud metadata services or private APIs. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:L/I:L) confirms network exploitation requires an authenticated WordPress account and high attack complexity, with scope change indicating cross-boundary impact on internal infrastructure. No active exploitation is confirmed - EPSS sits at 0.03% (10th percentile) and no KEV listing exists - placing this firmly in the low real-world priority tier despite the scope change.
Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.
The KiotViet Sync WordPress plugin through version 1.8.5 exposes restricted administrative functions to low-privileged authenticated users due to missing authorization checks (CWE-862), allowing unauthorized data modification via the plugin's sync operations. The flaw is network-exploitable with low privilege requirements and no user interaction, though impact is limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating very low exploitation probability despite the broken access control classification.
Missing authorization controls in the Baidu SEO Collection WordPress plugin versions up to 2.1.4 allow unauthenticated remote attackers to access restricted functionality and retrieve sensitive information without proper permission checks. The vulnerability affects the plugin's core access control mechanisms, enabling unauthorized information disclosure with a CVSS score of 5.3. EPSS exploitation probability is low at 0.03%, and no active exploitation has been confirmed.
Broken access control in the Sendle Shipping WordPress plugin (official-sendle-shipping-method) versions through 6.02 allows unauthenticated remote attackers to invoke plugin functionality that should be restricted to authorized users. The flaw stems from missing authorization checks (CWE-862), meaning certain shipping-related actions are accessible without any privilege verification. Real-world impact is limited to availability disruption (CVSS A:L), with no confidentiality or integrity impact identified. No public exploit code exists and EPSS places exploitation probability at 0.04% (11th percentile), indicating negligible active threat at time of analysis.
Cross-site request forgery in the Raychat WordPress plugin (versions through 2.2.1) enables an unauthenticated attacker to induce unauthorized state-changing actions on behalf of an authenticated user without their knowledge. The attack is constrained by a mandatory user-interaction requirement - a victim with an active authenticated session must visit a malicious page. EPSS at 0.02% (5th percentile) confirms negligible exploitation probability, and no public exploit or CISA KEV listing has been identified at time of analysis.
Missing authorization checks in WebinarPress (wp-webinarsystem) WordPress plugin version 1.33.28 and earlier allow authenticated low-privileged users to perform availability-impacting actions beyond their intended access level. The flaw stems from incorrectly configured access control security levels (CWE-862), enabling a WordPress subscriber-tier user to invoke plugin functionality restricted to higher roles. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS probability stands at 0.03%, indicating low real-world exploitation interest currently.
Link Whisper Free WordPress plugin through version 0.9.2 allows unauthenticated remote attackers to read sensitive information via missing authorization checks on API endpoints. The vulnerability enables bypassing access controls to retrieve data that should be restricted, confirmed with CVSS 5.3 and EPSS 0.03% exploitation probability. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.
Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.
Broken access control in RealMag777 MDTF (WordPress Meta Data Filter and Taxonomy Filter) plugin versions up to 1.3.6 allows low-privileged authenticated users to bypass authorization controls and access or modify sensitive metadata and taxonomy filter configurations. While rated CVSS 8.1 (High), real-world exploitation risk remains moderate with EPSS at 0.03% (9th percentile) and no confirmed active exploitation or public exploit code identified at time of analysis. This authentication bypass vulnerability was disclosed by Patchstack's security audit team.
DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.
Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.
Cross-Site Request Forgery in the Simple Content Templates WordPress plugin ≤2.2.61 allows unauthenticated attackers to trick logged-in administrators into performing unauthorized actions with low integrity impact. Exploitation requires victim interaction via a crafted link and has no known active exploitation or public exploit, while EPSS indicates a very low (0.02%) probability of widespread exploitation.
CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.
Broken access control in Revive Old Posts (tweet-old-post) WordPress plugin through version 9.3.3 allows authenticated attackers with low-level privileges to escalate permissions and execute high-impact operations including data exfiltration, modification, and service disruption. EPSS score of 0.05% (15th percentile) indicates low probability of mass exploitation, though the 8.8 CVSS score reflects significant potential damage once low-privilege access is obtained. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.
Broken access control in QuantumCloud ChatBot plugin for WordPress through version 7.7.3 allows authenticated attackers with low privileges to exploit misconfigured authorization checks, potentially leading to high-impact data breaches, unauthorized modifications, and service disruption. EPSS scoring indicates low exploitation probability (0.05%, 15th percentile), and no public exploit identified at time of analysis. The vulnerability stems from missing authorization controls (CWE-862), requiring only network access and low-privilege credentials with no user interaction, making it readily exploitable once an account is compromised.
Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.
Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.
An unauthenticated attacker can exploit missing authorization checks in the Everest Backup WordPress plugin (<=2.3.8) to trigger resource-intensive backup operations without any privileges, causing a low impact on server availability. No active exploitation or public proof-of-concept is known, and the EPSS score is very low (0.06%).
Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.
Unauthenticated access to CSV export data in the MSTW CSV EXPORTER plugin for WordPress versions up to 1.4 allows an attacker to retrieve exported information without any authentication. The issue arises from a missing authorization check on a publicly accessible export endpoint. No active exploitation or public exploit code is known, and the EPSS score of 0.06% indicates a very low probability of widespread exploitation.
Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.
Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.
Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.
Missing authorization in Reoon Email Verifier for WordPress allows authenticated users to exploit incorrectly configured access control, potentially causing low-impact service disruption. Affected versions up to 2.0.1 are vulnerable. No active exploitation or public exploit code is known, and EPSS indicates a 0.04% exploitation probability.
Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.
WordPress Table Block by RioVizual plugin versions through 3.0.0 contains a broken access control vulnerability allowing authenticated attackers with low privileges to bypass authorization checks and perform high-impact actions including data theft, modification, and service disruption. The CVSS score of 8.8 reflects network-accessible exploitation with low complexity requiring only minimal authentication. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, with no public exploit identified at time of analysis.
Broken access control in MSN Partner Hub WordPress plugin allows authenticated attackers with low privileges to bypass authorization controls and gain unauthorized access to high-privilege functions. This CWE-862 missing authorization flaw affects versions through 2.9, enabling authenticated users to execute actions beyond their intended permission level. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.
Unauthorized data access in PickPlugins Testimonial Slider for WordPress (≤2.0.15) enables low-privilege authenticated users to retrieve testimonials without proper authorization, leading to a confidentiality breach. The vulnerability allows any logged-in subscriber to read all testimonial entries, potentially exposing sensitive content. No active exploitation or public proof-of-concept is currently known.
An access control vulnerability in the SEO Meta Description Updater WordPress plugin (versions ≤1.2.0) allows low-privileged authenticated users to modify plugin settings without proper authorization. This missing authorization flaw (CWE-862) can be exploited over the network without user interaction, leading to unauthorized manipulation of SEO meta descriptions. No public exploit or active exploitation has been identified.
Confidential data exposure via missing authorization in Nelio Content WordPress plugin versions up to 4.0.5 allows authenticated low-privileged users (e.g., subscribers) to access information restricted to editors or administrators. The flaw carries a CVSS 6.5 score, but EPSS indicates very low exploitation probability (0.04%), and no public exploit or active exploitation has been identified.
Authenticated information disclosure in PickPlugins Post Grid and Gutenberg Blocks plugin for WordPress (≤2.3.17) allows low-privileged users to access sensitive post data due to missing authorization checks. The vulnerability requires a valid WordPress account with at least subscriber-level privileges but no user interaction. No public exploit code or active exploitation has been observed, and EPSS indicates a low probability of widespread exploitation (0.09%).
DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.
Unauthorized information disclosure in Export Categories plugin for WordPress through version 1.0 allows unauthenticated attackers to access category data due to a missing authorization check (CWE-862). Only category information is exposed, with no integrity or availability impact. The vulnerability has a low CVSS base score of 5.3, very low EPSS exploitation probability (0.04%), and no reports of active exploitation or public proof-of-concept.
Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.
Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.
Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.
Stored cross-site scripting in the Tooltipy (bluet-keywords-tooltip-generator) WordPress plugin through version 5.5.9 allows an authenticated attacker with low privileges to inject persistent malicious scripts into keyword tooltip data. When any site visitor views a page rendering the poisoned tooltip, the script executes in their browser under the site's origin, enabling session hijacking, credential theft, or further client-side attacks. No public exploit or active exploitation has been identified; EPSS is 0.02%, reflecting minimal current threat actor interest.
Broken access control in WP Flights & Hotels Booking WP Plugin (adiaha-hotel) versions ≤3.1 allows authenticated users with low privileges to bypass authorization checks and gain unauthorized access to high-impact functionality. Attackers can achieve complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization in Clicksend CF7 Plugin for WordPress versions ≤1.4.0 allows authenticated attackers to modify SMS notification settings without proper capability checks. The vulnerability has a low CVSS score of 4.3, no known public exploit, and an EPSS score of 0.06% indicating very low exploitation probability.
Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.
Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.
Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.
We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz
Missing authorization in Smart WeTransfer WordPress plugin up to version 1.3 allows authenticated users with low privileges to trigger actions that degrade service availability. The vulnerability is not known to be actively exploited, and EPSS indicates a low 0.04% probability of exploitation.
Stored cross-site scripting (XSS) in the WordPress plugin Custom Post Type Attachment (custom-post-type-pdf-attachment) up to version 3.4.6 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to session hijacking, defacement, or redirection to malicious sites. No active exploitation or public exploit code has been reported, but the vulnerability requires user interaction to trigger.
An access control weakness in Referral Link Tracker for WordPress up to 1.1.4 allows authenticated users with minimal privileges to interact with restricted plugin functionality, leading to limited availability impact. No data exposure or integrity tampering is indicated, and there is no evidence of active exploitation or public exploit code.
Stored cross-site scripting in the Query Posts WordPress plugin 0.3.2 and below allows an authenticated attacker with low privileges to inject malicious scripts that execute in the browser of users who view the affected page, leading to data theft or session hijacking. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Stored cross-site scripting in WordPress WP Geo plugin through version 3.5.1 enables authenticated attackers to inject malicious scripts that execute in victims' browsers. The vulnerability, reported by Patchstack, could allow session theft or content manipulation when a privileged user views a page containing the stored payload. No evidence of active exploitation exists, and the EPSS score is low (0.02%).
Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).
Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.
Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Stored cross-site scripting in the WordPress Links shortcode plugin up to version 1.8.3 allows authenticated attackers with low privileges to inject malicious scripts via the plugin's shortcode functionality. When a victim views a page containing the crafted shortcode, the injected script executes in their browser, leading to potential session theft, content manipulation, or redirection. No active exploitation or public exploit is reported, and EPSS indicates a low exploitation probability.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.
Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Stored Cross-Site Scripting vulnerability in ACF Recent Posts Widget WordPress plugin allows authenticated users with contributor-level access to inject malicious scripts into pages. Affects versions up to 5.9.3. EPSS score is very low (0.02%) and no public exploit or KEV listing identified, reducing immediate exploitation risk.
Unauthorized access to restricted functionality in Sunshine Photo Cart plugin for WordPress allows unauthenticated attackers to perform unauthorized actions. The vulnerability affects all versions up to and including 3.5.3, and stems from missing authorization checks that enable attackers to access functionality not properly constrained by Access Control Lists. With a low EPSS score (0.04%) and no reported active exploitation, the real-world risk is limited, though the flaw has a CVSS 5.3 medium rating.
Cross-site request forgery in the Off-Canvas Sidebars plugin for WordPress (≤0.5.8.5) allows unauthenticated attackers to trick administrators into modifying sidebar settings via a crafted link. Successful exploitation requires user interaction and leads to limited integrity impact with no confidentiality or availability consequences. No evidence of active exploitation or public exploit code exists at this time.
Broken access control in King Addons for Elementor (WordPress plugin) versions through 51.1.61 allows authenticated attackers with low privileges to bypass authorization checks and gain unauthorized access to high-privilege functionality. The CVSS 8.8 score reflects potential for full compromise (high confidentiality, integrity, and availability impact), though the EPSS score of 0.05% (15th percentile) indicates minimal real-world exploitation observed. No public exploit code or CISA KEV listing identified at time of analysis. The vulnerability stems from improperly configured access control security levels (CWE-862: Missing Authorization), enabling privilege escalation by low-privileged users.
DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.
Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.
Missing authorization in RelyWP Coupon Affiliates plugin (versions up to 7.2.0) allows unauthenticated remote attackers to access restricted functionality and read sensitive data due to inadequate access control list (ACL) enforcement. The vulnerability requires no authentication and has low attack complexity, enabling attackers to bypass WordPress permission checks and retrieve coupon-related information not intended for public access.
Authenticated low-privilege users of the Seriously Simple Podcasting WordPress plugin (version ≤ 3.13.0) can bypass access controls to modify podcast content. This missing authorization flaw (CWE-862) results from incorrectly configured access control security levels. Exploitation has not been observed in the wild (EPSS 0.03%).
Missing authorization checks in WP-Lister Lite for eBay 3.8.3 and earlier allow low-privileged authenticated attackers to modify plugin data. The vulnerability has a CVSS base score of 4.3 and an EPSS score of 0.03%, indicating low exploitation probability; no active exploitation is currently known.
Unauthorized data modification in Sovlix MeetingHub WordPress plugin through version 1.23.9 lets authenticated low-privilege attackers bypass authorization checks and alter meeting information. No active exploitation or public exploit is known; EPSS probability is 0.03%.
Missing authorization in the Front End Users WordPress plugin (≤3.2.33) allows authenticated attackers with low privileges to modify user data without proper access controls. The flaw stems from insufficient capability checks for certain actions, enabling unauthorized integrity impact with no confidentiality or availability loss. The vulnerability has a low EPSS score and no evidence of active exploitation or public exploits.
Missing authorization checks in the Repuso Social Proof Testimonials and Reviews widget for WordPress (<=5.29) allow authenticated attackers with low privileges to disrupt service availability. Exploitation probability is very low (EPSS 0.03%) and no active exploitation or public exploit code is known at this time.
Missing authorization checks in WPXPO WowRevenue 1.2.13 and earlier allow authenticated attackers with minimal privileges to modify plugin settings without proper capability checks, leading to limited integrity impact. This affects WordPress sites running the plugin and can be exploited remotely without user interaction.
Sensitive data exposure in ThemeRuby Easy Post Submission plugin for WordPress (<=1.7.0) allows authenticated administrators to retrieve embedded sensitive information from outbound data transmissions. The flaw leverages CWE-201 to leak low-impact confidentiality, integrity, and availability with high attack complexity and changed scope. No active exploitation or public exploit exists; EPSS probability is very low (0.04%).
Cross-site request forgery in the Product Catalog Simple WordPress plugin (versions ≤1.8.4) allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, potentially modifying catalog settings. The vulnerability has an extremely low EPSS exploitation probability (0.01%) and no known public exploit or active exploitation (not listed in CISA KEV).
An authenticated low-privilege user in WordPress with the One Page Express Companion plugin (versions ≤ 1.6.43) can exploit a missing authorization check to modify certain plugin data, leading to limited integrity impact. There is no known public exploit or active exploitation at this time.
Remote code execution in the s2Member WordPress plugin (≤ version 250905) allows unauthenticated attackers to inject and execute arbitrary PHP code, potentially leading to full site compromise. The vulnerability has a CVSS score of 9.0 but a very low EPSS exploitation probability (0.06%) and is not listed in CISA KEV; no public exploit is known at the time of analysis.
Unauthenticated access to sensitive data in BuddyPress up to version 14.3.4 allows remote attackers to read confidential information due to a missing authorization check. This vulnerability affects the popular WordPress social networking plugin and can be exploited without user interaction. Public exploit code is not known to exist, and EPSS indicates a very low probability (0.04%) of active exploitation.
Missing authorization in the Acknowledgify WordPress plugin (≤1.1.3) allows low-privilege authenticated users to modify plugin data without proper capability checks. The vulnerability, classified as CWE-862, carries a CVSS 3.1 base score of 4.3 (Medium) with low attack complexity and no user interaction. No public exploit or active exploitation has been reported, and EPSS assesses a 0.03% probability of exploitation.
WordPress UiChemy plugin up to 4.0.0 allows authenticated users with low privileges to modify plugin settings due to a missing authorization check. This could lead to unauthorized changes to plugin configuration. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of exploitation.