Wordpress Plugin
Monthly
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated REST API access in the wiseCampaign - WooCommerce Conversions Made Easy WordPress plugin (all versions through 1.1.16) allows any network attacker to read and overwrite the plugin's banner, stockbar, and core settings, and to upload arbitrary background image files via wp_handle_upload(), with zero authentication or nonce validation. Every REST endpoint the plugin registers uses the blanket permission callback '__return_true', which bypasses WordPress's built-in capability and nonce checks entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes this straightforward to exploit opportunistically.
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Sensitive information exposure in the Page and Post Restriction WordPress plugin (versions ≤ 1.4.0) allows unauthenticated attackers to read the full rendered content of every published page and post on sites relying on the plugin's global privacy toggles. The plugin's REST API guards - `papr_restrict_page_post_rest_api()` and the `the_posts` filter in `papr_filter_posts()` - consult only per-post/page metabox settings and completely ignore the 'Make all Pages Private' and 'Make all Posts Private' global options, leaving the `/wp-json/wp/v2/pages` and `/wp-json/wp/v2/posts` endpoints unguarded. No public exploit is identified at time of analysis, but the attack is trivially executable with a single unauthenticated HTTP GET request.
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.
OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom `do_backups` capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of `esc_attr()`, an HTML sanitizer, as a shell sanitizer in the `restoreBackup()` AJAX handler, enabling shell metacharacter injection into an `exec()` call. This represents an incomplete remediation of CVE-2023-7002; the equivalent fix applied to `handleQuickMigration()` was never ported to the `$backupName` variable path. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).
Unauthenticated access to the Material Dashboard WordPress plugin's task management AJAX endpoint exposes all WordPress sites running versions up to and including 1.4.10 to task enumeration, arbitrary task execution, and task deletion. The root cause is a missing capability check on the `amd_ajax_target_task_manager()` function, which is registered via the publicly accessible `public_amd_ajax_handler` AJAX action - reachable without any authentication by design of the hook registration. An attacker can enumerate scheduled tasks (potentially exposing PII stored in task parameters), force arbitrary task execution to trigger unintended server-side operations, or delete tasks to disrupt site functionality. No active exploitation confirmed at time of analysis; no public POC code referenced in available data.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
Unauthenticated sensitive information exposure in the AI Copilot - Content Generator plugin for WordPress (versions up to and including 1.4.6) allows any remote attacker to retrieve plaintext OpenAI API keys and full AI model configurations. The `getCurrentTaskResults()` method is exposed via `wp_ajax_nopriv_` AJAX hooks with no nonce validation, no authorization checks, and no permission guard - making task results freely accessible to unauthenticated callers. Attackers who enumerate sequential integer task IDs can exfiltrate every stored API key, prompt configuration, and keyword set from the site's database. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is trivially exploitable given the low attack complexity.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.
Arbitrary file deletion via path traversal in the Nex Forms - Ultimate Form Builder - Lite WordPress plugin (versions up to and including 9.2.3) allows authenticated attackers to delete any file on the server, including the critical wp-config.php. The flaw stems from a two-stage attack chain: the insert_record() AJAX handler accepts unsanitized file paths (wp_kses() strips only HTML, not traversal sequences) into a database column, which the delete_file() AJAX handler then passes directly to PHP's unlink() without realpath(), basename(), or allowlist validation. By default this requires admin-level access, but the plugin's configurable user-level option may reduce the privilege requirement to lower roles. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute arbitrary PHP on the server by submitting a crafted POST request to a vulnerable form. The _save_data() function fails to validate the 'thisPermalink' POST field before it overwrites a trusted callable placeholder, which is then passed unsanitized to call_user_func(). Exploitation is conditional on a specific form configuration (see exploitation_conditions), reflected in the CVSS AC:H rating; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unspecified vulnerability in the Falcon - WordPress Optimizations & Tweaks plugin up to version 2.10.0 allows remote, unauthenticated attackers to cause a denial of service due to improper input validation (CWE-1284). The high-severity flaw (CVSS 7.5) impacts availability with no user interaction required. No public exploit or active exploitation has been confirmed, and EPSS data is unavailable.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Arbitrary file deletion and read access in the File Manager WordPress plugin (versions 6.0-6.9) allows any authenticated user with subscriber-level access or above to delete or read arbitrary server files, including wp-config.php, which can be leveraged for remote code execution. The flaw is rooted in a parameter-source discrepancy in elFinder's connector: the bind registration for the rm.pre permission handler reads exclusively from $_POST, while the dispatcher reads from the merged $_GET+$_POST superglobal - allowing an attacker to inject cmd=rm or cmf=file via the URL query string of a POST request, entirely bypassing authorization checks. A patched version (6.9.1) has been released per the WordPress plugin repository changeset; no public exploit has been identified at time of analysis, though the Wordfence disclosure provides sufficient technical specificity for exploitation.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated REST API access in the wiseCampaign - WooCommerce Conversions Made Easy WordPress plugin (all versions through 1.1.16) allows any network attacker to read and overwrite the plugin's banner, stockbar, and core settings, and to upload arbitrary background image files via wp_handle_upload(), with zero authentication or nonce validation. Every REST endpoint the plugin registers uses the blanket permission callback '__return_true', which bypasses WordPress's built-in capability and nonce checks entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes this straightforward to exploit opportunistically.
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.
Unauthorized data modification in the Easy Post Submission plugin for WordPress (all versions through 2.3.0) lets unauthenticated attackers overwrite the title, content, excerpt, categories, tags, and publication status of any existing post by supplying its postId to a public AJAX endpoint. Because the rbsm_submit_post action is registered for logged-out users with no capability check, an anonymous request can silently rewrite or unpublish arbitrary site content, an integrity- and content-availability-focused flaw scored CVSS 9.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary PHP function execution in ShopLentor (woolentor-addons) for WordPress up to and including version 3.3.7 allows authenticated administrators to invoke any PHP callable on the server via the woolentoropt/v1/custom-action REST API endpoint. The root cause is the plugin's handle_action() method passing the user-supplied 'callback' parameter directly into PHP's call_user_func() with no allowlist restriction, enabling full server-side code execution under the web server's privilege context. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the admin-level requirement limits the realistic attacker pool to compromised or malicious site administrators.
Sensitive information exposure in the Page and Post Restriction WordPress plugin (versions ≤ 1.4.0) allows unauthenticated attackers to read the full rendered content of every published page and post on sites relying on the plugin's global privacy toggles. The plugin's REST API guards - `papr_restrict_page_post_rest_api()` and the `the_posts` filter in `papr_filter_posts()` - consult only per-post/page metabox settings and completely ignore the 'Make all Pages Private' and 'Make all Posts Private' global options, leaving the `/wp-json/wp/v2/pages` and `/wp-json/wp/v2/posts` endpoints unguarded. No public exploit is identified at time of analysis, but the attack is trivially executable with a single unauthenticated HTTP GET request.
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.
OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom `do_backups` capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of `esc_attr()`, an HTML sanitizer, as a shell sanitizer in the `restoreBackup()` AJAX handler, enabling shell metacharacter injection into an `exec()` call. This represents an incomplete remediation of CVE-2023-7002; the equivalent fix applied to `handleQuickMigration()` was never ported to the `$backupName` variable path. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
Arbitrary file upload in LightSync Pro WordPress plugin (all versions through 2.1.6) enables authenticated attackers with Author-level access to upload executable files - including PHP webshells - via the unvalidated `rest_replace_media()` REST API function, with remote code execution as a realistic outcome. The root cause is CWE-434: missing file type validation on the server side, allowing any file extension to be accepted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS score of 8.8 reflects the high post-exploitation impact given the minimal privilege bar (Author role).
Unauthenticated access to the Material Dashboard WordPress plugin's task management AJAX endpoint exposes all WordPress sites running versions up to and including 1.4.10 to task enumeration, arbitrary task execution, and task deletion. The root cause is a missing capability check on the `amd_ajax_target_task_manager()` function, which is registered via the publicly accessible `public_amd_ajax_handler` AJAX action - reachable without any authentication by design of the hook registration. An attacker can enumerate scheduled tasks (potentially exposing PII stored in task parameters), force arbitrary task execution to trigger unintended server-side operations, or delete tasks to disrupt site functionality. No active exploitation confirmed at time of analysis; no public POC code referenced in available data.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
Unauthenticated sensitive information exposure in the AI Copilot - Content Generator plugin for WordPress (versions up to and including 1.4.6) allows any remote attacker to retrieve plaintext OpenAI API keys and full AI model configurations. The `getCurrentTaskResults()` method is exposed via `wp_ajax_nopriv_` AJAX hooks with no nonce validation, no authorization checks, and no permission guard - making task results freely accessible to unauthenticated callers. Attackers who enumerate sequential integer task IDs can exfiltrate every stored API key, prompt configuration, and keyword set from the site's database. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is trivially exploitable given the low attack complexity.
Unauthorized arbitrary media deletion in the Multi Uploader for Gravity Forms WordPress plugin (all versions through 1.1.8) lets unauthenticated attackers permanently destroy any media library attachment. The flaw stems from the AJAX file-delete handler being wired to the nopriv hook without a capability check, while the CSRF nonce is leaked in page source, defeating the only protection present. No public exploit is identified at time of analysis, but exploitation is trivial and the EPSS/KEV signals are not yet populated for this recently disclosed issue.
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Privilege escalation in the Smart Popup by Supsystic WordPress plugin (all versions through 1.12.0) enables unauthenticated remote attackers to create persistent WordPress Administrator accounts with attacker-controlled credentials. Three compounding flaws are chained: a PHP `array_merge()` collision silently removes the `save` action from the popup module's permission blocklist, the subscription confirmation email leaks a reusable `pps_nonce` that the `wp_ajax_nopriv_save` endpoint accepts, and `createWpSubscriber()` applies no server-side role allowlist - allowing an attacker to freely set `params[tpl][sub_wp_create_user_role]=administrator`. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack chain is fully described in the CVE and the low complexity makes independent weaponization likely.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
Privilege escalation in Dokan (WordPress multivendor marketplace plugin) versions up to and including 5.0.1 enables any authenticated vendor or seller to read, modify, or delete any WordPress user account - including site administrators - via REST API calls to `/wp-json/dokan/v1/customers/{id}`. The plugin's `CustomersController` re-registers WooCommerce's customer CRUD routes but replaces the native `manage_woocommerce` capability gate with a flawed check that inspects only the requesting user's role and never validates authorization against the target user. Setting the `password` parameter on an administrator's record via a PUT request yields full site takeover. No public exploit identified at time of analysis, though the attack is mechanically trivial for any Vendor-role account holder.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.
Arbitrary file deletion via path traversal in the Nex Forms - Ultimate Form Builder - Lite WordPress plugin (versions up to and including 9.2.3) allows authenticated attackers to delete any file on the server, including the critical wp-config.php. The flaw stems from a two-stage attack chain: the insert_record() AJAX handler accepts unsanitized file paths (wp_kses() strips only HTML, not traversal sequences) into a database column, which the delete_file() AJAX handler then passes directly to PHP's unlink() without realpath(), basename(), or allowlist validation. By default this requires admin-level access, but the plugin's configurable user-level option may reduce the privilege requirement to lower roles. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute arbitrary PHP on the server by submitting a crafted POST request to a vulnerable form. The _save_data() function fails to validate the 'thisPermalink' POST field before it overwrites a trusted callable placeholder, which is then passed unsanitized to call_user_func(). Exploitation is conditional on a specific form configuration (see exploitation_conditions), reflected in the CVSS AC:H rating; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical).
Unauthenticated directory traversal in the Bit Integrations WordPress plugin (all versions through 2.9.0) allows remote attackers to read arbitrary files from the server via the processAttachment function. The flaw resides in mail action handling (MailController.php) and Contact Form 7 trigger processing (CF7Controller.php), exposing sensitive server files such as wp-config.php, .env files, and credentials to any unauthenticated network attacker. No public exploit or CISA KEV listing has been identified at the time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) and EPSS-independent attack simplicity make this a high-priority patching target for affected installations.
Privilege escalation in the Subscriptions for WooCommerce WordPress plugin (versions up to and including 2.0.0) allows authenticated Contributors to elevate their accounts to Administrator by poisoning a membership plan's stored role meta. The `save_meta_boxes()` function accepts the `_wps_plan_user_role` POST parameter with no server-side allowlist blocking privileged roles; the only guards applied - `sanitize_key()` and `wp_roles()->is_role()` - both pass 'administrator' as valid. Full exploitation requires the companion Pro plugin to be active, as it is the component that reads the stored meta and calls `add_role()` during membership lifecycle events. No public exploit has been identified at time of analysis, though Wordfence has published full technical detail and the vulnerable source lines are publicly browsable.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unspecified vulnerability in the Falcon - WordPress Optimizations & Tweaks plugin up to version 2.10.0 allows remote, unauthenticated attackers to cause a denial of service due to improper input validation (CWE-1284). The high-severity flaw (CVSS 7.5) impacts availability with no user interaction required. No public exploit or active exploitation has been confirmed, and EPSS data is unavailable.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.