Wordpress Plugin
Monthly
Cross-site request forgery in the WordPress UPC/EAN/GTIN Barcode Generator plugin (versions through 2.0.2) allows unauthenticated remote attackers to trick authenticated administrators into performing unauthorized actions, such as altering plugin settings or barcode output, with low integrity impact. No active exploitation or public exploit code has been identified, and the EPSS score is extremely low, indicating minimal real-world risk.
Missing authorization in WP SMS plugin for WordPress up to 7.0.1 allows authenticated attackers to modify SMS settings and message content. This could alter notification behavior or enable limited service disruption, but the impact is moderate and requires low-privilege authentication. No active exploitation or public exploit code has been reported, and EPSS indicates very low exploitation probability.
PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Arbitrary file deletion in PT Luxa Addons WordPress plugin versions ≤1.2.2 allows authenticated attackers with low privileges (e.g., subscriber) to delete arbitrary files on the server via path traversal, leading to denial of service. The vulnerability is remotely exploitable but requires an authenticated account; no public exploit or active exploitation has been observed at this time, and EPSS indicates a very low exploitation probability (0.06%).
Cross-Site Request Forgery in the WP Media Categories plugin for WordPress allows unauthenticated attackers to trick a logged-in administrator into making unauthorized requests, potentially altering media category settings. The vulnerability affects versions up to 2.1.0 and has a low integrity impact with no confidentiality or availability loss. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.02%).
Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.
Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.
Password recovery exploitation in WordPress Emails Catch All plugin <=3.5.3 allows low-privileged authenticated attackers to reset any user’s password via an authentication bypass using an alternate channel. Successful exploitation grants full access to the target WordPress site, including data theft and site takeover. While rated High severity, the EPSS signal indicates very low real-world exploitation probability and no active exploitation is confirmed at this time.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Information disclosure in the MasterStudy LMS WordPress plugin up to version 3.6.20 allows high-privilege authenticated admins to retrieve embedded sensitive data. With a CVSS score of 4.9 and EPSS probability of 0.04%, no active exploitation or public exploit is known. The vulnerability requires administrative access, limiting real-world risk.
We are tasked with producing a comprehensive JSON analysis. The input provides CVE ID, description, CVSS vector, CWE, and some multi-source intel: EPSS score (0.07%, percentile 22%), tags "Path Traversal", and a reference to Patchstack. There is no KEV listing, no explicit POC availability, no patch version stated beyond "through <= 3.3.5", meaning affected versions up to 3.3.5. The reference URL is a Patchstack advisory. Let's read the URL content? Not provided directly but the advisory likely describes the vulnerability. Since we only have the description, we need to synthesize using all data: CVE description, CVSS vector, EPSS, tags, reference. There is no CPE string, but the product is "Workreap (theme's plugin) workreap" from AmentoTech. It is a WordPress theme plugin. The CVSS vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. So attack vector Network, low complexity, privileges required Low, no user interaction, scope changed, confidentiality none, integrity none, availability high. That suggests a path traversal leading to availability impact (file deletion maybe? The Patchstack URL says "arbitrary-file-deletion-vulnerability", confirming impact: arbitrary file deletion via path traversal. The CWE-22 path traversal. Now, we need to produce fields. Let's start. product_name: "Workreap" (1-3 words, the specific product name). So "Workreap" is the theme's plugin. Could be "Workreap plugin" but only 1-3 words, so "Workreap". If "Workreap (theme's plugin)" that's more than 3 words, but "Workreap" alone is fine. summary: synthesize: Path traversal vulnerability in Workreap plugin for WordPress (theme's plugin) through version 3.3.5 allows authenticated attackers (PR:L) to delete arbitrary files on the server, causing denial of service (A:H). No confidentiality or integrity impact, but high availability impact. EPSS 0.07% indicates low exploit likelihood. No KEV listing. Not mention of active exploitation. So: "Authenticated attackers can exploit a path traversal vulnerability in Workreap plugin versions <= 3.3.5 to delete arbitrary files, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network-based low-complexity attack with no user interaction beyond authentication. EPSS score of 0.07% suggests low probability of exploitation in the wild, and no evidence of active exploitation is available." That's a good summary. technical_context: Mention underlying technology: WordPress plugin, path traversal due to improper sanitization of user-supplied input in file operations. CWE-22. Product Workreap by AmentoTech, a theme plugin. CPE data not provided, but we can infer CPES: likely cpe:2.3:a:amentotech:workreap:... The reference Patchstack advisory shows the plugin slug "workreap". The vulnerability leads to arbitrary file deletion. The affected product is the Workreap plugin. So technical_context: "The Workreap plugin is a WordPress theme companion plugin that likely handles file uploads or paths, where insufficient sanitization allows a path traversal attack (CWE-22). An attacker with low-privilege user access can manipulate file paths to traverse directories, potentially deleting files outside the intended directory. The CVSS vector confirms network attack vector, low attack complexity, and no user interaction required after authentication." risk_assessment: Use CVSS vector: Network, low complexity, low privileges, no UI, scope changed, no CIA except A:H. So a low-privileged (e.g., subscriber) user can cause denial of service by deleting files. EPSS 0.07% (low probability). No KEV, no POC mentioned. SSVC decision might be: exploitation none, automatable yes (network, low complexity), technical impact partial (availability only), so priority might be lower. So risk is moderate: high CVSS but low EPSS suggests while the impact is serious, exploitation is not widespread or likely. "Risk is moderate: CVSS 7.7 indicates a critical availability impact, but the EPSS score of 0.07% (22nd percentile) suggests very low probability of real-world exploitation. No active exploitation or publicly available exploit code is reported. The attack requires authenticated access (low privileges), which reduces the attack surface slightly. However, the low complexity and network vector make it automatable once authenticated." affected_products: "Workreap plugin for WordPress versions n/a through 3.3.5. The vendor is AmentoTech. For details, see Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plugin-3-3-5-arbitrary-file-deletion-vulnerability?_s_id=cve" That's concise. remediation: There's no patch information in input other than "through <= 3.3.5", implying that versions up to 3.3.5 are affected. Typically, a fix would be in a later version, but the advisory might not specify. The Patchstack URL might have remediation. Since we don't have the content, we must rely on the description: "through <=3.3.5" so fix likely in version after 3.3.5. We should state: "Upgrade Workreap plugin to a patched version later than 3.3.5. If no update is available, consider disabling the plugin or restricting file access permissions on the server to limit impact. Monitor the vendor’s release page and Patchstack advisory for updates." However, we can't confirm a specific version. So: "No patched version is specified in the available data; however, versions up to 3.3.5 are affected. Immediately update to a version newer than 3.3.5 when released, or disable the plugin until a fix is available. As a compensating control, restrict the web server process's write permissions to critical directories, though this may affect plugin functionality. Refer to the Patchstack advisory for official remediation." exploit_scenario: "An authenticated user, such as a subscriber, sends a malicious request with a crafted file path parameter to a vulnerable endpoint in the Workreap plugin, leveraging path traversal sequences (e.g., "../") to specify a target file outside the intended directory. The application processes the path without proper sanitization, resulting in deletion of that file and causing service disruption." That's realistic. No POC noted, so no mention. exploitation_conditions: Need to extract specific conditions from description. The description says: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal." So the vulnerability exists when the plugin processes file paths (likely during file deletion operations). The CVSS says PR:L, so attacker must have low privileges (authenticated as subscriber or similar). No user interaction. So conditions: "The attacker must have a low-privilege user account on the WordPress site (authenticated). The Workreap plugin must be active and the vulnerable endpoint accessible. No special feature needs to be enabled beyond the plugin's normal operation. Exploitation does not require user interaction." That's it. attack_chain: We'll craft a chain: "Authenticate to WordPress as low-privilege user → Craft malicious request with path traversal payload targeting sensitive file → Send request to vulnerable Workreap endpoint → Plugin processes path without sanitization → File at traversed path is deleted → Service disruption (denial of service due to missing critical file)." confidence_notes: "Exploitation conditions derived from CVSS vector (PR:L) and Patchstack advisory. No public exploit availability confirmed. No CISA KEV listing. EPSS suggests low exploitation likelihood. Patch availability not specified in the input; update guidance inferred from affected version range." prevalence: "medium" - Workreap is a WordPress theme plugin, probably used by some websites but not as ubiquitous as core plugins. Could be low? But I'd estimate medium: WordPress plugin usage is common, but it's a theme-specific plugin, not a general-purpose plugin. So "low" might be more accurate. However, we need to be real: theme companion plugins can have decent install base. But without stats, I'd say "medium" is safe. Prevalence basis: "WordPress theme companion plugin used with Workreap theme". So "medium" because it's not a top plugin but tied to a commercial theme. I'll put prevalence "low"? Let's see input: no install numbers. I'll gauge: "AmentoTech Workreap" theme's plugin. ThemeForest maybe. I'll check: "workreap" theme on ThemeForest has ~3,000 sales? That might be low. So prevalence "low". Prevalence basis: "commercial WordPress theme plugin with limited install base". So prevalence: "low". If unknown, we could say unknown, but we can estimate. I'll go with "low". Prevalence basis: "specialized commercial theme companion plugin, not widely deployed". assessed_cvss_vector: My own independent CVSS. The given vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. I need to output my own assessment. It seems accurate: network attack vector, low complexity, privileges low, no user interaction, scope changed because the vulnerable component is the plugin and the impact is on the file system? Actually, scope changed because the vulnerable component (plugin) impacts a resource outside its scope (other files on server). S:C is appropriate. Impact: confidentiality none (C:N), integrity none (I:N), availability high (A:H). So I'd output the same vector. Rationale: "Authenticated low-privilege user can delete arbitrary files, causing availability impact; no confidentiality or integrity loss." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H". For CVSS 4.0: I need to map. CVSS 4.0 base vector: AV:N, AC:L, AT:N (no attack requirement specified), PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system availability high), SC:N, SI:N, SA:N (subsequent system? The scope changed in 3.1 is handled differently in 4.0. In CVSS 4.0, if there is a scope change, the impact to the subsequent system (the one whose security relies on the vulnerable component) is denoted by SC, SI, SA. The vulnerable system itself is the plugin component, which has VC, VI, VA. Since the vulnerability only deletes files (affect the system's availability), VA:H. The subsequent system (the filesystem) is the same host, but the scope is changed: the vulnerable component is the plugin and the impact is on the server files. In CVSS 4.0, scope is not explicitly captured the same way; instead, we have vulnerable system metrics and subsequent system metrics. The attacker's action affects the vulnerable component with VA:H (availability of the plugin? Actually, the file deletion impacts the server's availability, not the plugin's availability. But CVSS 4.0 definition: "Vulnerable System metrics refer to the system that contains the vulnerable component and is most directly impacted by the vulnerability." The plugin is the vulnerable component, and the system hosting it is the vulnerable system. The availability impact on that system is high (server files deleted, causing DoS). So VC:N, VI:N, VA:H. No subsequent system impact because the vulnerability directly affects the vulnerable system. So SC, SI, SA are N. So CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. That seems right. The 3.1 scope change translates to a CVSS 4.0 situation where the vulnerable system is the server (the component is the plugin), and there is no subsequent system. Actually, in 3.1 scope changed because the component (plugin) is separate from the impacted resource (files). In 4.0, that's captured by the fact that the vulnerable system is the server, and the vulnerability impacts the server's availability. So no subsequent system. So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Good. assessed_cvss_rationale: "Authenticated low-privileged network attack requires no user interaction, targeting file deletion causing high availability impact, no confidentiality or integrity loss." assessed_cvss40_vector: as above. Now, all fields must be plain text
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Unauthenticated remote code execution in TF Woo Product Grid Addon for Elementor versions up to 1.0.1 allows complete site compromise via PHP object injection. The vulnerability stems from insecure deserialization (CWE-502) of untrusted input, exploitable without authentication or user interaction. No
Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.
Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.
Arbitrary file deletion in the Taskbot WordPress plugin through version 6.4 allows authenticated low-privilege users to delete critical files via path traversal, leading to denial of service. No active exploitation or public exploit is reported; EPSS score is low (0.07%).
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.
Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Privilege escalation in Dokan (WordPress multi-vendor marketplace plugin) versions up to 4.1.3 allows high-privileged users to elevate their permissions beyond intended role boundaries. Reported by Patchstack audit team with EPSS exploitation probability of 0.08% (24th percentile), indicating low real-world exploitation likelihood. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.
Information disclosure in PickPlugins Accordion WordPress plugin up to version 2.3.14 allows authenticated low-privileged users to access confidential data via missing authorization checks. The vulnerability has a CVSS 6.5 and a low EPSS score of 0.05%, indicating no active exploitation or public exploit at this time.
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Arbitrary file upload in the WordPress Zippy plugin (<=1.7.0) allows authenticated administrators to upload malicious files, leading to remote code execution and full server compromise. No public exploit or active exploitation has been identified at time of analysis. EPSS score of 0.06% indicates low likelihood of widespread exploitation.
Missing authorization in the Wikipedia Preview WordPress plugin (≤1.15.0) allows unauthenticated attackers to perform actions that should require authentication, leading to limited integrity and availability impact. Exploitation requires no user interaction and has low attack complexity, but no public exploit or active exploitation is reported, and the EPSS score is very low (0.04%). The flaw enables attackers to modify or disrupt plugin functionality without being authenticated.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Missing authorization in the Breeze Checkout WordPress plugin (versions through 1.4.0) exposes restricted functionality to unauthenticated network attackers, enabling low-impact integrity and availability manipulation. The vulnerability stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that the requesting party holds appropriate permissions before executing privileged operations. No public exploit code has been identified and EPSS probability sits at 0.05% (15th percentile), indicating low current exploitation activity despite the ease of network access implied by the CVSS vector.
Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.
Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.
Missing authorization in the Templazee WordPress plugin (versions through 1.0.2) permits authenticated low-privileged users to invoke restricted plugin functionality by exploiting improperly enforced access control boundaries. The CVSS PR:L metric confirms that a valid WordPress account with minimal privileges - such as a subscriber - is sufficient to trigger the flaw over the network with no additional interaction required. No public exploit code is identified at time of analysis, and an EPSS score of 0.01% (1st percentile) signals extremely low observed exploitation probability.
Broken access control in the Smash Balloon Social Post Feed WordPress plugin (versions up to and including 4.3.2) allows authenticated users with low privileges to perform unauthorized modifications of social feed data or settings due to missing authorization checks. No active exploitation or public exploit has been identified at this time, and EPSS indicates very low exploitation probability.
Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.
DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.
Insufficient authorization checks in the WPeMatico RSS Feed Fetcher WordPress plugin (versions ≤2.8.3) allow authenticated attackers with low privileges (e.g., Subscriber) to modify plugin configurations without proper access control. No active exploitation or public exploit code has been reported; the EPSS probability is very low (0.05%).
Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.
The accessiBe WordPress plugin through version 2.10 fails to enforce proper authorization checks, allowing authenticated attackers with low privileges to modify restricted plugin settings and affect availability without authorization. This missing authorization vulnerability (CWE-862) can be exploited over the network with low attack complexity, leading to limited integrity and availability impacts (no confidentiality impact). No active exploitation or public exploit code has been identified at this time.
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
Unauthenticated, remote integrity impact in the CoSchedule WordPress plugin through version 3.4.0 stems from a missing authorization check. Attackers can modify plugin data without user interaction, but the low EPSS score of 0.04% and absence of known exploitation or public proof-of-concept limit real-world urgency. CVSS rates it 5.3, reflecting the low integrity-only impact.
Missing authorization in the MDTF (WordPress Meta Data & Taxonomy Filter) plugin up to version 1.3.3.9 allows authenticated low-privileged users to bypass intended access controls. An attacker with a subscriber-level account could exploit this flaw to cause a limited availability impact, such as disrupting the plugin's functionality. The flaw is rated Medium severity with an EPSS score of 0.03%, indicating a low probability of large-scale exploitation.
Unauthenticated attackers can access functionality in WPComplete versions up to 2.9.5.3 that is not properly constrained by access controls, resulting in a low availability impact. The vulnerability (CWE-862) has a CVSS 5.3 score and an EPSS exploitation probability of only 0.04%, indicating low real-world risk.
Unauthenticated integrity modification in ZoloBlocks WordPress plugin up to 2.3.11 due to missing authorization checks. The vulnerability enables remote attackers to perform unauthorized changes with low integrity impact, with no confidentiality or availability impact. EPSS score is low (0.04%), indicating a very low probability of widespread exploitation.
The Whydonate WordPress plugin through version 4.0.15 lacks proper authorization checks, enabling unauthenticated attackers to remotely access restricted functionality. This can lead to service disruption or resource exhaustion, with no data exposure or system compromise. No active exploitation is reported, but the public advisory confirms the flaw.
SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.
Missing authorization in Hydra Booking plugin versions <=1.1.9 allows authenticated low-privilege users to bypass access controls and perform unauthorized actions on booking data. An attacker could view, modify, or disrupt limited booking information, with no indication of active exploitation or publicly available exploit code.
Unauthorized functionality modification in DELUCKS SEO WordPress plugin versions 2.5.9 and below allows unauthenticated attackers to alter plugin data due to missing access controls. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability despite the network‑accessible attack vector.
Server-Side Request Forgery in the Captcha.eu WordPress plugin (versions ≤ 1.0.61) allows unauthenticated remote attackers to make the server issue requests to internal or external services. This can lead to information disclosure or limited interaction with other systems, though high attack complexity reduces exploitability. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world attacks.
Cross-Site Request Forgery (CSRF) in the Evergreen Content Poster WordPress plugin through version 1.4.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of an authenticated administrator. An attacker can trick a logged-in admin into clicking a crafted link, leading to CSRF exploitation that modifies plugin settings or content with low integrity impact. No active exploitation or public exploit code has been reported; EPSS probability is negligible.
Local file inclusion in WP Abstracts (wp-abstracts-manuscripts-manager) plugin for WordPress versions ≤ 2.7.4 allows unauthenticated attackers to read arbitrary local files. Exploitation requires user interaction and high attack complexity, potentially leading to full server compromise. The EPSS probability is very low (0.05%), and no active exploitation or public exploit code is currently known.
Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check. The affected component is the custom-css-editor, which can be triggered remotely without authentication, resulting in partial integrity and availability impact. No active exploitation or public proof-of-concept is known, and the EPSS score of 0.04% indicates low likelihood of widespread attacks.
SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.
High integrity impact vulnerability in WordPress Tablesome Table Premium plugin versions <= 1.1.23 allows unauthenticated attackers to modify plugin functionality due to missing authorization checks. An attacker can access features not properly constrained by ACLs, potentially altering table configurations or data. No active exploitation or public exploit code is reported, but the flaw is remotely exploitable with low complexity.
Stored cross-site scripting (XSS) in the Memberlite Shortcodes WordPress plugin through version 1.4.1 allows authenticated attackers to inject arbitrary web scripts. This vulnerability can lead to session hijacking or arbitrary actions executed in the context of the victim's browser when they view a page containing malicious shortcode content. No active exploitation or public exploit code has been identified at time of analysis.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments allows Stored XSS.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style allows Stored XSS.0.4. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader allows Server Side Request Forgery.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS.8.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp allows Stored XSS.2.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSRF vulnerability in Flytedesk Digital WordPress plugin through version 20181101 enables stored cross-site scripting (XSS) attacks. Remote attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript into the application, affecting site visitors. EPSS score of 0.01% indicates minimal observed exploitation activity, and no public exploit code or active exploitation has been identified at time of analysis.
CSRF vulnerability in HTACCESS IP Blocker WordPress plugin enables stored XSS attacks against site administrators. Attackers can trick authenticated WordPress administrators into executing malicious actions that inject persistent JavaScript payloads through unprotected plugin endpoints. Affects all versions through 1.0. EPSS score of 0.01% (3rd percentile) suggests minimal observed exploitation attempts, though the attack requires only user interaction (UI:R) with no authentication barrier for the attacker. No active exploitation confirmed via CISA KEV at time of analysis.
Stored cross-site scripting can be injected into W3SCloud Contact Form 7 to Zoho CRM plugin for WordPress (versions through 3.0) via CSRF attack, allowing unauthenticated remote attackers to execute malicious JavaScript in administrator sessions when admins are tricked into visiting attacker-controlled pages. The vulnerability chains CSRF (CWE-352) with stored XSS, enabling privilege escalation from no access to stored administrative malicious code. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor allows Retrieve Embedded Sensitive Data.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO allows Exploiting Incorrectly Configured Access Control Security Levels.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) in NewsmanApp WordPress plugin versions up to 2.7.7 enables stored Cross-Site Scripting (XSS) attacks through unauthorized administrative actions. Attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript payloads, leading to session hijacking, privilege escalation, or further compromise of WordPress sites. EPSS score of 0.01% (3rd percentile) indicates very low observed exploitation probability. No active exploitation confirmed in CISA KEV. Patchstack vulnerability database is the primary authoritative source for this disclosure.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count allows DOM-Based XSS.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows DOM-Based XSS.1.61. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in BdThemes ZoloBlocks zoloblocks allows Server Side Request Forgery.3.11. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products allows Stored XSS.0.5. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System allows Stored XSS.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in loopus WP Virtual Assistant allows Exploiting Incorrectly Configured Access Control Security Levels.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Disclaimer Buttons allows Stored XSS.41. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Subscribe To Unlock WordPress plugin versions up to 1.1.5 allows authenticated attackers with low privileges to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, sensitive data disclosure, or full site compromise. EPSS score of 0.11% (29th percentile) indicates low probability of mass exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Subscribe to Download WordPress plugin versions up to 2.0.9 allows authenticated attackers with low privileges to read arbitrary files on the server via manipulated PHP include paths. EPSS exploitation probability is low at 0.11% (29th percentile), and no active exploitation is confirmed in CISA KEV. The vulnerability requires authentication (PR:L) and high attack complexity (AC:H), limiting widespread exploitation risk despite the 7.5 CVSS score. Patchstack has documented this vulnerability, suggesting detection signatures exist for web application firewalls.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Ott Notely allows Stored XSS.8.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in wpshuffle Subscribe to Download allows Exploiting Incorrectly Configured Access Control Security Levels.0.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed allows Stored XSS.3.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages allows Stored XSS.3.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler allows Cross Site Request Forgery.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler allows Stored XSS.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in netgsm Netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.9.58. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags allows DOM-Based XSS.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal allows Stored XSS.3.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal allows Retrieve Embedded Sensitive Data.3.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery in the WordPress UPC/EAN/GTIN Barcode Generator plugin (versions through 2.0.2) allows unauthenticated remote attackers to trick authenticated administrators into performing unauthorized actions, such as altering plugin settings or barcode output, with low integrity impact. No active exploitation or public exploit code has been identified, and the EPSS score is extremely low, indicating minimal real-world risk.
Missing authorization in WP SMS plugin for WordPress up to 7.0.1 allows authenticated attackers to modify SMS settings and message content. This could alter notification behavior or enable limited service disruption, but the impact is moderate and requires low-privilege authentication. No active exploitation or public exploit code has been reported, and EPSS indicates very low exploitation probability.
PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Arbitrary file deletion in PT Luxa Addons WordPress plugin versions ≤1.2.2 allows authenticated attackers with low privileges (e.g., subscriber) to delete arbitrary files on the server via path traversal, leading to denial of service. The vulnerability is remotely exploitable but requires an authenticated account; no public exploit or active exploitation has been observed at this time, and EPSS indicates a very low exploitation probability (0.06%).
Cross-Site Request Forgery in the WP Media Categories plugin for WordPress allows unauthenticated attackers to trick a logged-in administrator into making unauthorized requests, potentially altering media category settings. The vulnerability affects versions up to 2.1.0 and has a low integrity impact with no confidentiality or availability loss. No evidence of active exploitation or public exploit code exists, and the EPSS probability is extremely low (0.02%).
Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.
Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.
Password recovery exploitation in WordPress Emails Catch All plugin <=3.5.3 allows low-privileged authenticated attackers to reset any user’s password via an authentication bypass using an alternate channel. Successful exploitation grants full access to the target WordPress site, including data theft and site takeover. While rated High severity, the EPSS signal indicates very low real-world exploitation probability and no active exploitation is confirmed at this time.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Information disclosure in the MasterStudy LMS WordPress plugin up to version 3.6.20 allows high-privilege authenticated admins to retrieve embedded sensitive data. With a CVSS score of 4.9 and EPSS probability of 0.04%, no active exploitation or public exploit is known. The vulnerability requires administrative access, limiting real-world risk.
We are tasked with producing a comprehensive JSON analysis. The input provides CVE ID, description, CVSS vector, CWE, and some multi-source intel: EPSS score (0.07%, percentile 22%), tags "Path Traversal", and a reference to Patchstack. There is no KEV listing, no explicit POC availability, no patch version stated beyond "through <= 3.3.5", meaning affected versions up to 3.3.5. The reference URL is a Patchstack advisory. Let's read the URL content? Not provided directly but the advisory likely describes the vulnerability. Since we only have the description, we need to synthesize using all data: CVE description, CVSS vector, EPSS, tags, reference. There is no CPE string, but the product is "Workreap (theme's plugin) workreap" from AmentoTech. It is a WordPress theme plugin. The CVSS vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. So attack vector Network, low complexity, privileges required Low, no user interaction, scope changed, confidentiality none, integrity none, availability high. That suggests a path traversal leading to availability impact (file deletion maybe? The Patchstack URL says "arbitrary-file-deletion-vulnerability", confirming impact: arbitrary file deletion via path traversal. The CWE-22 path traversal. Now, we need to produce fields. Let's start. product_name: "Workreap" (1-3 words, the specific product name). So "Workreap" is the theme's plugin. Could be "Workreap plugin" but only 1-3 words, so "Workreap". If "Workreap (theme's plugin)" that's more than 3 words, but "Workreap" alone is fine. summary: synthesize: Path traversal vulnerability in Workreap plugin for WordPress (theme's plugin) through version 3.3.5 allows authenticated attackers (PR:L) to delete arbitrary files on the server, causing denial of service (A:H). No confidentiality or integrity impact, but high availability impact. EPSS 0.07% indicates low exploit likelihood. No KEV listing. Not mention of active exploitation. So: "Authenticated attackers can exploit a path traversal vulnerability in Workreap plugin versions <= 3.3.5 to delete arbitrary files, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network-based low-complexity attack with no user interaction beyond authentication. EPSS score of 0.07% suggests low probability of exploitation in the wild, and no evidence of active exploitation is available." That's a good summary. technical_context: Mention underlying technology: WordPress plugin, path traversal due to improper sanitization of user-supplied input in file operations. CWE-22. Product Workreap by AmentoTech, a theme plugin. CPE data not provided, but we can infer CPES: likely cpe:2.3:a:amentotech:workreap:... The reference Patchstack advisory shows the plugin slug "workreap". The vulnerability leads to arbitrary file deletion. The affected product is the Workreap plugin. So technical_context: "The Workreap plugin is a WordPress theme companion plugin that likely handles file uploads or paths, where insufficient sanitization allows a path traversal attack (CWE-22). An attacker with low-privilege user access can manipulate file paths to traverse directories, potentially deleting files outside the intended directory. The CVSS vector confirms network attack vector, low attack complexity, and no user interaction required after authentication." risk_assessment: Use CVSS vector: Network, low complexity, low privileges, no UI, scope changed, no CIA except A:H. So a low-privileged (e.g., subscriber) user can cause denial of service by deleting files. EPSS 0.07% (low probability). No KEV, no POC mentioned. SSVC decision might be: exploitation none, automatable yes (network, low complexity), technical impact partial (availability only), so priority might be lower. So risk is moderate: high CVSS but low EPSS suggests while the impact is serious, exploitation is not widespread or likely. "Risk is moderate: CVSS 7.7 indicates a critical availability impact, but the EPSS score of 0.07% (22nd percentile) suggests very low probability of real-world exploitation. No active exploitation or publicly available exploit code is reported. The attack requires authenticated access (low privileges), which reduces the attack surface slightly. However, the low complexity and network vector make it automatable once authenticated." affected_products: "Workreap plugin for WordPress versions n/a through 3.3.5. The vendor is AmentoTech. For details, see Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plugin-3-3-5-arbitrary-file-deletion-vulnerability?_s_id=cve" That's concise. remediation: There's no patch information in input other than "through <= 3.3.5", implying that versions up to 3.3.5 are affected. Typically, a fix would be in a later version, but the advisory might not specify. The Patchstack URL might have remediation. Since we don't have the content, we must rely on the description: "through <=3.3.5" so fix likely in version after 3.3.5. We should state: "Upgrade Workreap plugin to a patched version later than 3.3.5. If no update is available, consider disabling the plugin or restricting file access permissions on the server to limit impact. Monitor the vendor’s release page and Patchstack advisory for updates." However, we can't confirm a specific version. So: "No patched version is specified in the available data; however, versions up to 3.3.5 are affected. Immediately update to a version newer than 3.3.5 when released, or disable the plugin until a fix is available. As a compensating control, restrict the web server process's write permissions to critical directories, though this may affect plugin functionality. Refer to the Patchstack advisory for official remediation." exploit_scenario: "An authenticated user, such as a subscriber, sends a malicious request with a crafted file path parameter to a vulnerable endpoint in the Workreap plugin, leveraging path traversal sequences (e.g., "../") to specify a target file outside the intended directory. The application processes the path without proper sanitization, resulting in deletion of that file and causing service disruption." That's realistic. No POC noted, so no mention. exploitation_conditions: Need to extract specific conditions from description. The description says: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal." So the vulnerability exists when the plugin processes file paths (likely during file deletion operations). The CVSS says PR:L, so attacker must have low privileges (authenticated as subscriber or similar). No user interaction. So conditions: "The attacker must have a low-privilege user account on the WordPress site (authenticated). The Workreap plugin must be active and the vulnerable endpoint accessible. No special feature needs to be enabled beyond the plugin's normal operation. Exploitation does not require user interaction." That's it. attack_chain: We'll craft a chain: "Authenticate to WordPress as low-privilege user → Craft malicious request with path traversal payload targeting sensitive file → Send request to vulnerable Workreap endpoint → Plugin processes path without sanitization → File at traversed path is deleted → Service disruption (denial of service due to missing critical file)." confidence_notes: "Exploitation conditions derived from CVSS vector (PR:L) and Patchstack advisory. No public exploit availability confirmed. No CISA KEV listing. EPSS suggests low exploitation likelihood. Patch availability not specified in the input; update guidance inferred from affected version range." prevalence: "medium" - Workreap is a WordPress theme plugin, probably used by some websites but not as ubiquitous as core plugins. Could be low? But I'd estimate medium: WordPress plugin usage is common, but it's a theme-specific plugin, not a general-purpose plugin. So "low" might be more accurate. However, we need to be real: theme companion plugins can have decent install base. But without stats, I'd say "medium" is safe. Prevalence basis: "WordPress theme companion plugin used with Workreap theme". So "medium" because it's not a top plugin but tied to a commercial theme. I'll put prevalence "low"? Let's see input: no install numbers. I'll gauge: "AmentoTech Workreap" theme's plugin. ThemeForest maybe. I'll check: "workreap" theme on ThemeForest has ~3,000 sales? That might be low. So prevalence "low". Prevalence basis: "commercial WordPress theme plugin with limited install base". So prevalence: "low". If unknown, we could say unknown, but we can estimate. I'll go with "low". Prevalence basis: "specialized commercial theme companion plugin, not widely deployed". assessed_cvss_vector: My own independent CVSS. The given vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. I need to output my own assessment. It seems accurate: network attack vector, low complexity, privileges low, no user interaction, scope changed because the vulnerable component is the plugin and the impact is on the file system? Actually, scope changed because the vulnerable component (plugin) impacts a resource outside its scope (other files on server). S:C is appropriate. Impact: confidentiality none (C:N), integrity none (I:N), availability high (A:H). So I'd output the same vector. Rationale: "Authenticated low-privilege user can delete arbitrary files, causing availability impact; no confidentiality or integrity loss." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H". For CVSS 4.0: I need to map. CVSS 4.0 base vector: AV:N, AC:L, AT:N (no attack requirement specified), PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system availability high), SC:N, SI:N, SA:N (subsequent system? The scope changed in 3.1 is handled differently in 4.0. In CVSS 4.0, if there is a scope change, the impact to the subsequent system (the one whose security relies on the vulnerable component) is denoted by SC, SI, SA. The vulnerable system itself is the plugin component, which has VC, VI, VA. Since the vulnerability only deletes files (affect the system's availability), VA:H. The subsequent system (the filesystem) is the same host, but the scope is changed: the vulnerable component is the plugin and the impact is on the server files. In CVSS 4.0, scope is not explicitly captured the same way; instead, we have vulnerable system metrics and subsequent system metrics. The attacker's action affects the vulnerable component with VA:H (availability of the plugin? Actually, the file deletion impacts the server's availability, not the plugin's availability. But CVSS 4.0 definition: "Vulnerable System metrics refer to the system that contains the vulnerable component and is most directly impacted by the vulnerability." The plugin is the vulnerable component, and the system hosting it is the vulnerable system. The availability impact on that system is high (server files deleted, causing DoS). So VC:N, VI:N, VA:H. No subsequent system impact because the vulnerability directly affects the vulnerable system. So SC, SI, SA are N. So CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. That seems right. The 3.1 scope change translates to a CVSS 4.0 situation where the vulnerable system is the server (the component is the plugin), and there is no subsequent system. Actually, in 3.1 scope changed because the component (plugin) is separate from the impacted resource (files). In 4.0, that's captured by the fact that the vulnerable system is the server, and the vulnerability impacts the server's availability. So no subsequent system. So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Good. assessed_cvss_rationale: "Authenticated low-privileged network attack requires no user interaction, targeting file deletion causing high availability impact, no confidentiality or integrity loss." assessed_cvss40_vector: as above. Now, all fields must be plain text
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Unauthenticated remote code execution in TF Woo Product Grid Addon for Elementor versions up to 1.0.1 allows complete site compromise via PHP object injection. The vulnerability stems from insecure deserialization (CWE-502) of untrusted input, exploitable without authentication or user interaction. No
Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.
Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.
Arbitrary file deletion in the Taskbot WordPress plugin through version 6.4 allows authenticated low-privilege users to delete critical files via path traversal, leading to denial of service. No active exploitation or public exploit is reported; EPSS score is low (0.07%).
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.
Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Privilege escalation in Dokan (WordPress multi-vendor marketplace plugin) versions up to 4.1.3 allows high-privileged users to elevate their permissions beyond intended role boundaries. Reported by Patchstack audit team with EPSS exploitation probability of 0.08% (24th percentile), indicating low real-world exploitation likelihood. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.
Information disclosure in PickPlugins Accordion WordPress plugin up to version 2.3.14 allows authenticated low-privileged users to access confidential data via missing authorization checks. The vulnerability has a CVSS 6.5 and a low EPSS score of 0.05%, indicating no active exploitation or public exploit at this time.
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Arbitrary file upload in the WordPress Zippy plugin (<=1.7.0) allows authenticated administrators to upload malicious files, leading to remote code execution and full server compromise. No public exploit or active exploitation has been identified at time of analysis. EPSS score of 0.06% indicates low likelihood of widespread exploitation.
Missing authorization in the Wikipedia Preview WordPress plugin (≤1.15.0) allows unauthenticated attackers to perform actions that should require authentication, leading to limited integrity and availability impact. Exploitation requires no user interaction and has low attack complexity, but no public exploit or active exploitation is reported, and the EPSS score is very low (0.04%). The flaw enables attackers to modify or disrupt plugin functionality without being authenticated.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Missing authorization in the Breeze Checkout WordPress plugin (versions through 1.4.0) exposes restricted functionality to unauthenticated network attackers, enabling low-impact integrity and availability manipulation. The vulnerability stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that the requesting party holds appropriate permissions before executing privileged operations. No public exploit code has been identified and EPSS probability sits at 0.05% (15th percentile), indicating low current exploitation activity despite the ease of network access implied by the CVSS vector.
Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.
Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.
Missing authorization in the Templazee WordPress plugin (versions through 1.0.2) permits authenticated low-privileged users to invoke restricted plugin functionality by exploiting improperly enforced access control boundaries. The CVSS PR:L metric confirms that a valid WordPress account with minimal privileges - such as a subscriber - is sufficient to trigger the flaw over the network with no additional interaction required. No public exploit code is identified at time of analysis, and an EPSS score of 0.01% (1st percentile) signals extremely low observed exploitation probability.
Broken access control in the Smash Balloon Social Post Feed WordPress plugin (versions up to and including 4.3.2) allows authenticated users with low privileges to perform unauthorized modifications of social feed data or settings due to missing authorization checks. No active exploitation or public exploit has been identified at this time, and EPSS indicates very low exploitation probability.
Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.
DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.
Insufficient authorization checks in the WPeMatico RSS Feed Fetcher WordPress plugin (versions ≤2.8.3) allow authenticated attackers with low privileges (e.g., Subscriber) to modify plugin configurations without proper access control. No active exploitation or public exploit code has been reported; the EPSS probability is very low (0.05%).
Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.
The accessiBe WordPress plugin through version 2.10 fails to enforce proper authorization checks, allowing authenticated attackers with low privileges to modify restricted plugin settings and affect availability without authorization. This missing authorization vulnerability (CWE-862) can be exploited over the network with low attack complexity, leading to limited integrity and availability impacts (no confidentiality impact). No active exploitation or public exploit code has been identified at this time.
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
Unauthenticated, remote integrity impact in the CoSchedule WordPress plugin through version 3.4.0 stems from a missing authorization check. Attackers can modify plugin data without user interaction, but the low EPSS score of 0.04% and absence of known exploitation or public proof-of-concept limit real-world urgency. CVSS rates it 5.3, reflecting the low integrity-only impact.
Missing authorization in the MDTF (WordPress Meta Data & Taxonomy Filter) plugin up to version 1.3.3.9 allows authenticated low-privileged users to bypass intended access controls. An attacker with a subscriber-level account could exploit this flaw to cause a limited availability impact, such as disrupting the plugin's functionality. The flaw is rated Medium severity with an EPSS score of 0.03%, indicating a low probability of large-scale exploitation.
Unauthenticated attackers can access functionality in WPComplete versions up to 2.9.5.3 that is not properly constrained by access controls, resulting in a low availability impact. The vulnerability (CWE-862) has a CVSS 5.3 score and an EPSS exploitation probability of only 0.04%, indicating low real-world risk.
Unauthenticated integrity modification in ZoloBlocks WordPress plugin up to 2.3.11 due to missing authorization checks. The vulnerability enables remote attackers to perform unauthorized changes with low integrity impact, with no confidentiality or availability impact. EPSS score is low (0.04%), indicating a very low probability of widespread exploitation.
The Whydonate WordPress plugin through version 4.0.15 lacks proper authorization checks, enabling unauthenticated attackers to remotely access restricted functionality. This can lead to service disruption or resource exhaustion, with no data exposure or system compromise. No active exploitation is reported, but the public advisory confirms the flaw.
SQL injection in the Hydra Booking WordPress booking plugin (versions through 1.1.10) allows authenticated users with low privileges to extract sensitive data from the underlying database, with a scope-changed CVSS rating indicating the injection may reach beyond WordPress-specific tables to other databases accessible by the shared MySQL user. The vulnerability requires only a low-privilege account (PR:L) and no user interaction, making it exploitable by any registered WordPress user. No public exploit code or active exploitation has been identified; EPSS stands at 0.07% (21st percentile), suggesting low real-world exploitation activity at time of analysis.
Missing authorization in Hydra Booking plugin versions <=1.1.9 allows authenticated low-privilege users to bypass access controls and perform unauthorized actions on booking data. An attacker could view, modify, or disrupt limited booking information, with no indication of active exploitation or publicly available exploit code.
Unauthorized functionality modification in DELUCKS SEO WordPress plugin versions 2.5.9 and below allows unauthenticated attackers to alter plugin data due to missing access controls. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability despite the network‑accessible attack vector.
Server-Side Request Forgery in the Captcha.eu WordPress plugin (versions ≤ 1.0.61) allows unauthenticated remote attackers to make the server issue requests to internal or external services. This can lead to information disclosure or limited interaction with other systems, though high attack complexity reduces exploitability. No active exploitation or public exploit code is known, and EPSS indicates a very low probability of real-world attacks.
Cross-Site Request Forgery (CSRF) in the Evergreen Content Poster WordPress plugin through version 1.4.5 allows unauthenticated remote attackers to perform unauthorized actions on behalf of an authenticated administrator. An attacker can trick a logged-in admin into clicking a crafted link, leading to CSRF exploitation that modifies plugin settings or content with low integrity impact. No active exploitation or public exploit code has been reported; EPSS probability is negligible.
Local file inclusion in WP Abstracts (wp-abstracts-manuscripts-manager) plugin for WordPress versions ≤ 2.7.4 allows unauthenticated attackers to read arbitrary local files. Exploitation requires user interaction and high attack complexity, potentially leading to full server compromise. The EPSS probability is very low (0.05%), and no active exploitation or public exploit code is currently known.
Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check. The affected component is the custom-css-editor, which can be triggered remotely without authentication, resulting in partial integrity and availability impact. No active exploitation or public proof-of-concept is known, and the EPSS score of 0.04% indicates low likelihood of widespread attacks.
SQL injection in the AnyComment WordPress commenting plugin (versions through 0.3.6) allows authenticated low-privilege users to extract data from the underlying WordPress MySQL database by sending crafted requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection can traverse beyond the plugin's own tables and reach the full WordPress database schema - including wp_users, wp_options, and other sensitive stores. No public exploit identified at time of analysis; EPSS at 0.03% (8th percentile) reflects very low current exploitation likelihood.
High integrity impact vulnerability in WordPress Tablesome Table Premium plugin versions <= 1.1.23 allows unauthenticated attackers to modify plugin functionality due to missing authorization checks. An attacker can access features not properly constrained by ACLs, potentially altering table configurations or data. No active exploitation or public exploit code is reported, but the flaw is remotely exploitable with low complexity.
Stored cross-site scripting (XSS) in the Memberlite Shortcodes WordPress plugin through version 1.4.1 allows authenticated attackers to inject arbitrary web scripts. This vulnerability can lead to session hijacking or arbitrary actions executed in the context of the victim's browser when they view a page containing malicious shortcode content. No active exploitation or public exploit code has been identified at time of analysis.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments allows Stored XSS.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style allows Stored XSS.0.4. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader allows Server Side Request Forgery.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS.8.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp allows Stored XSS.2.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSRF vulnerability in Flytedesk Digital WordPress plugin through version 20181101 enables stored cross-site scripting (XSS) attacks. Remote attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript into the application, affecting site visitors. EPSS score of 0.01% indicates minimal observed exploitation activity, and no public exploit code or active exploitation has been identified at time of analysis.
CSRF vulnerability in HTACCESS IP Blocker WordPress plugin enables stored XSS attacks against site administrators. Attackers can trick authenticated WordPress administrators into executing malicious actions that inject persistent JavaScript payloads through unprotected plugin endpoints. Affects all versions through 1.0. EPSS score of 0.01% (3rd percentile) suggests minimal observed exploitation attempts, though the attack requires only user interaction (UI:R) with no authentication barrier for the attacker. No active exploitation confirmed via CISA KEV at time of analysis.
Stored cross-site scripting can be injected into W3SCloud Contact Form 7 to Zoho CRM plugin for WordPress (versions through 3.0) via CSRF attack, allowing unauthenticated remote attackers to execute malicious JavaScript in administrator sessions when admins are tricked into visiting attacker-controlled pages. The vulnerability chains CSRF (CWE-352) with stored XSS, enabling privilege escalation from no access to stored administrative malicious code. EPSS score of 0.01% (3rd percentile) indicates minimal observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor allows Retrieve Embedded Sensitive Data.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO allows Exploiting Incorrectly Configured Access Control Security Levels.0.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) in NewsmanApp WordPress plugin versions up to 2.7.7 enables stored Cross-Site Scripting (XSS) attacks through unauthorized administrative actions. Attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript payloads, leading to session hijacking, privilege escalation, or further compromise of WordPress sites. EPSS score of 0.01% (3rd percentile) indicates very low observed exploitation probability. No active exploitation confirmed in CISA KEV. Patchstack vulnerability database is the primary authoritative source for this disclosure.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count allows DOM-Based XSS.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows DOM-Based XSS.1.61. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in BdThemes ZoloBlocks zoloblocks allows Server Side Request Forgery.3.11. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products allows Stored XSS.0.5. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System allows Stored XSS.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in loopus WP Virtual Assistant allows Exploiting Incorrectly Configured Access Control Security Levels.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Disclaimer Buttons allows Stored XSS.41. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Subscribe To Unlock WordPress plugin versions up to 1.1.5 allows authenticated attackers with low privileges to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, sensitive data disclosure, or full site compromise. EPSS score of 0.11% (29th percentile) indicates low probability of mass exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Subscribe to Download WordPress plugin versions up to 2.0.9 allows authenticated attackers with low privileges to read arbitrary files on the server via manipulated PHP include paths. EPSS exploitation probability is low at 0.11% (29th percentile), and no active exploitation is confirmed in CISA KEV. The vulnerability requires authentication (PR:L) and high attack complexity (AC:H), limiting widespread exploitation risk despite the 7.5 CVSS score. Patchstack has documented this vulnerability, suggesting detection signatures exist for web application firewalls.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Ott Notely allows Stored XSS.8.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in wpshuffle Subscribe to Download allows Exploiting Incorrectly Configured Access Control Security Levels.0.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed allows Stored XSS.3.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages allows Stored XSS.3.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler allows Cross Site Request Forgery.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler allows Stored XSS.2. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in netgsm Netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.9.58. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags allows DOM-Based XSS.5. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal allows Stored XSS.3.3. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal allows Retrieve Embedded Sensitive Data.3.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.