Wordpress Plugin
Monthly
Cross-site request forgery in the WordPress Import CDN-Remote Images plugin versions up to 2.1.2 enables stored cross-site scripting attacks through forged requests that bypass CSRF protections. An attacker can craft malicious requests to inject persistent JavaScript payloads into the plugin's configuration or imported content, affecting WordPress installations running vulnerable versions of the plugin. The vulnerability carries low exploitation probability (EPSS 0.02%) and no public exploit code has been identified.
Missing authorization controls in the Real Estate Property 2024 Create Your Own Fields and Search Bar WordPress plugin (versions up to 4.48) permit unauthenticated or low-privileged users to access functionality and data intended for higher privilege levels. The vulnerability stems from inadequately configured access control checks on plugin endpoints, allowing attackers to bypass intended security boundaries. With an EPSS score of 0.05% (17th percentile), real-world exploitation risk is minimal, and no public exploit code or active exploitation has been identified.
Arbitrary file movement in HT Contact Form Widget for Elementor & Gutenberg (WordPress plugin) allows unanatuhenticated remote attackers to relocate server files including wp-config.php, enabling remote code execution. Affects all versions through 2.2.1. Vulnerability stems from insufficient path validation in handle_files_upload() function. No public exploit identified at time of analysis, low observed exploitation activity.
Arbitrary file deletion in HT Contact Form Widget For Elementor (WordPress plugin) allows unanetworks attackers to remove critical server files, enabling remote code execution. Affecting all versions through 2.2.1, the vulnerability stems from insufficient path validation in temp_file_delete(), permitting deletion of wp-config.php or other essential files. CVSS 9.1 (Critical) with network attack vector, low complexity, and no authentication required. Vendor patch available (changeset 3326887). No public exploit identified at time of analysis, though the attack path is straightforward for skilled adversaries.
Unauthenticated remote code execution in HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks plugin (all versions ≤2.2.1) allows attackers to upload arbitrary files to the WordPress server. Missing file type validation in temp_file_upload() function enables unrestricted file uploads, permitting execution of malicious scripts. Critical severity (CVSS 9.8) due to network-accessible attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis.
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
The Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and restore-info.json. Unauthenticated attackers can discover and download complete site backups containing the database, wp-config.php with credentials, and all uploaded files.
The Friends plugin for WordPress versions up to 3.5.1 contains a PHP Object Injection vulnerability in the query_vars parameter that allows authenticated subscribers and above to inject malicious serialized objects through unsafe deserialization. While the plugin itself lacks a known gadget chain (POP chain), successful exploitation depends on the presence of vulnerable code in other installed plugins or themes; if such a chain exists, attackers can achieve arbitrary file deletion, data exfiltration, or remote code execution, but exploitation requires knowledge of the site's SALT_NONCE and SALT_KEY values.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upload_handle() function due to missing file type validation, allowing unauthenticated attackers to upload malicious files and potentially achieve remote code execution. With a CVSS score of 9.8, network-accessible attack vector, and no authentication requirement, this vulnerability poses an immediate and severe threat to any WordPress installation using the affected plugin.
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
A SSRF vulnerability in for WordPress is vulnerable to Server-Side Request Forgery in all (CVSS 7.2). High severity vulnerability requiring prompt remediation. Vendor patch is available.
The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 61.0% and no vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36848. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.0% and no vendor patch available.
The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
The Lightbox & Modal Popup WordPress Plugin - FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Essential Addons for Elementor - Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin up to version 3.4.1 allows remote attackers to execute arbitrary SQL commands, primarily compromising database confidentiality. While rated Critical (CVSS 9.3) with a network attack vector, the EPSS probability of exploitation is only 0.04%, and no public exploits or active exploitation have been reported.
Unauthenticated SQL injection in the WordPress plugin Video List Manager through version 1.7 allows remote attackers to execute arbitrary SQL commands on the backing database, leading to exposure of sensitive data and potential partial denial of service. No authentication or user interaction is required, and the attack vector is network-accessible, but the EPSS exploitation probability is very low (0.04%), and no active exploitation or public exploit code is known at this time.
Blind SQL injection in bSecure – Your Universal Checkout WordPress plugin allows unauthenticated remote attackers to exfiltrate sensitive database contents, including user credentials and order data, via crafted HTTP requests to the checkout endpoint. The vulnerability affects all plugin versions up to 1.7.9 and requires no user interaction or special privileges. While no active exploitation or public exploit is currently known (EPSS 0.04%, not listed in CISA KEV), the CVSS 9.3 critical score reflects the high ease of exploitation and severe confidentiality impact across a changed scope, making patching a high priority.
A security vulnerability in Missing Authorization vulnerability in pietro MobiLoud (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the Leyka WordPress plugin through version 3.31.9 allows unauthenticated attackers with no privileges to include and execute arbitrary PHP files on the server, potentially leading to full site compromise. Exploitation requires user interaction (tricking an administrator to click a malicious link) and achieves high impact on confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
A security vulnerability in Missing Authorization vulnerability in vgwort VG WORT METIS (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A security vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Unauthenticated SQL injection in the Cozmoslabs Paid Member Subscriptions WordPress plugin up to version 2.15.1 allows remote attackers with no privileges to execute arbitrary SQL commands via a specially crafted request. Successful exploitation can expose highly sensitive data from the database, with a low but possible impact on availability. The vulnerability carries a CVSS base score of 7.5 (High), an EPSS score of 0.03% indicating very low exploitation likelihood, and no known public exploit or active attacks at the time of analysis.
Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (versions through 4.6.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL. Successful exploitation can lead to session token theft, credential harvesting, or malicious redirect depending on attacker-controlled payload. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% reflects low current exploitation probability.
Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.
Server-side request forgery in TeconceTheme Allmart 1.0.0 allows unauthenticated remote attackers to force the WordPress site to make requests to internal
Arbitrary file upload in the FW Gallery WordPress plugin (by Fastw3b LLC) affects all versions up to and including 8.0.0, letting remote attackers upload files of dangerous types (e.g. PHP webshells) with no authentication. Successful exploitation yields server-side code execution and full site compromise. It carries a maximum CVSS 3.1 base score of 10.0, but has no public exploit identified at time of analysis and a low EPSS of 0.07% (22nd percentile), and is not listed in CISA KEV.
Path traversal in DynamiApps Frontend Admin (WordPress plugin) up to version 3.28.7 allows an authenticated high-privileged attacker to read arbitrary files on the server, leading to exposure of sensitive information. No public exploit is known, and EPSS score suggests low exploitation likelihood.
Remote code execution in Easy Stripe WordPress plugin version 1.1 and earlier allows unauthenticated attackers to inject and execute arbitrary code on the underlying server. The vulnerability has a critical CVSS score of 10.0 but EPSS indicates a low exploitation probability (0.07%), and no active exploitation has been reported.
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting vulnerability in the Booking Calendar Contact Form plugin for WordPress allows authenticated users with low privileges to inject arbitrary JavaScript into stored booking entries. When other users view these entries, the script executes, potentially leading to session theft or site defacement. No active exploitation or public exploit code has been identified, and the EPSS probability is very low (0.03%).
Unauthorized settings modification in WC Pickup Store (WordPress plugin by Keylor Mendoza) versions up to 1.8.9 allows unauthenticated attackers to alter plugin configuration, potentially disrupting pickup store operations. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS probability is very low (0.06%).
Local file inclusion in the PrivateContent - Mail Actions WordPress plugin allows unauthenticated attackers to include arbitrary local files, leading to potential remote code execution or sensitive data disclosure. Affects versions up to 2.3.2, with exploitation requiring user interaction and high attack complexity. No active exploitation or public exploit code has been reported as of this analysis.
A security vulnerability in Missing Authorization vulnerability in ashanjay EventON (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in AresIT WP Compress allows Authentication Abuse (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
Authenticated SQL injection in the Simple Link Directory WordPress plugin up to version 14.7.3 allows low-privileged users to exfiltrate sensitive database contents. No public exploit or active exploitation has been confirmed, and the EPSS score of 0.04% indicates a very low likelihood of real-world attacks despite a CVSS 8.5 rating.
SQL injection in the Click & Pledge Connect WordPress plugin allows unauthenticated attackers to escalate privileges and potentially compromise affected sites. The vulnerability exists in versions 25.04010101 through WP6.8 and carries a critical CVSS score due to its full technical impact and easy exploitability, though no public exploit or active exploitation has been observed.
Path traversal leading to arbitrary file deletion in the Aviation Weather from NOAA WordPress plugin (versions through 0.7.2) allows an authenticated attacker to delete files outside the plugin's intended directory scope. The Patchstack advisory confirms the impact is arbitrary file deletion rather than disclosure, consistent with the CVSS vector showing A:H with C:N/I:N. Exploitation requires a low-privilege WordPress account, and no public exploit or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in the WebEmailProtector WordPress plugin (≤3.3.6) allows authenticated attackers with low-privilege accounts (e.g., Contributor) to inject malicious scripts into plugin settings, causing script execution in administrators' browsers. No public exploit or active exploitation has been reported, and EPSS probability is very low (0.03%).
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
Privilege escalation in Service Finder Booking plugin for WordPress allows unauthenticated attackers to gain full administrative control. This vulnerability, affecting all versions up to 6.0, arises from incorrect privilege assignment (CWE-266) and carries a CVSS score of 9.8, though EPSS indicates a low exploitation probability (0.08%) with no public exploit or active exploitation known.
Cross-Site Request Forgery in the Radio Station plugin for WordPress 2.5.12 and earlier allows unauthenticated attackers to perform actions on behalf of authenticated users if tricked into clicking a crafted link, leading to unauthorized changes with low integrity impact. The vulnerability is not known to be actively exploited, and no public exploit code has been identified.
Stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to 7.8 allows authenticated attackers with low privileges to inject malicious scripts into the statistics display pages. When an administrator views the affected page, the script executes in their browser, potentially leading to session hijacking, data theft, or administrative actions. Currently no public exploit or active exploitation has been reported, and the EPSS score is low (0.03%), indicating limited immediate risk.
DOM-based cross-site scripting in the WordPress Card flip image slideshow plugin (<= 1.5) allows authenticated attackers to execute arbitrary JavaScript in victims’ browsers. Exploitation requires at least contributor-level access and user interaction; impact includes session theft and defacement. No evidence of active exploitation or public exploit code exists, and EPSS indicates a very low probability of real-world attacks.
SQL injection in the gopiplus Pixelating image slideshow gallery WordPress plugin (versions ≤ 8.0) allows authenticated attackers with low privileges to execute arbitrary SQL queries, enabling unauthorized extraction of sensitive database information and potential disruption via costly queries. No public
Authenticated SQL injection in iFrame Images Gallery plugin up to version 9.0 allows any user with subscriber-level access to extract sensitive information from the WordPress database, including password hashes. No public exploit or active exploitation has been confirmed, and the EPSS score is extremely low (0.04%), indicating minimal real-world exploitation activity at this time.
Blind SQL injection in the Cool fade popup WordPress plugin allows authenticated low-privilege attackers to extract sensitive data from the database. The vulnerability affects all versions up to 10.1. Exploitation requires only subscriber-level access and no user interaction, making it easily exploitable once authenticated, though EPSS score is low (0.04%) and no public exploit or active exploitation is known.
DOM-based Cross-Site Scripting (XSS) in Aakif Kadiwala Posts Slider Shortcode plugin for WordPress up to version 1.0 allows authenticated attackers with low-level privileges to execute arbitrary scripts in the browsers of site visitors who view a vulnerable page. Exploitation could lead to session hijacking, defacement, or redirection. No active exploitation is confirmed, and EPSS estimates only a 0.03% probability of widespread exploitation, indicating low real-world risk despite the medium CVSS score.
A security vulnerability in Missing Authorization vulnerability in amazewp fluXtore (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in LMSACE Connect plugin for WordPress up to version 3.4 allows authenticated low‑privilege users to bypass access controls and modify plugin data. No public exploit code or active exploitation is known, and EPSS stands at 0.04%, indicating very low immediate risk.
SQL injection in the cybio Gallery Widget plugin for WordPress up to version 1.2.1 allows authenticated attackers with low privileges (e.g., Subscriber) to extract sensitive database information and cause limited availability disruptions. No active exploitation or public exploit is known, and the EPSS exploitation probability is very low (0.04%).
SQL injection in the Contact Us page – Contact people LITE WordPress plugin allows authenticated low-privileged users to extract sensitive data from the WordPress database. Versions through 3.7.4 are affected; an attacker needs a valid subscriber-level (or higher) account to exploit it. EPSS probability is very low, and no active exploitation or public exploit code has been identified.
Server-Side Request Forgery in Md Yeasin Ul Haider's URL Shortener WordPress plugin (≤3.0.7) allows unauthenticated attackers to force the server to make arbitrary requests, potentially accessing internal resources. The attack has high complexity and limited impact on confidentiality and integrity. No active exploitation is reported, and EPSS exploitation probability is very low (0.03%).
Stored cross-site scripting (XSS) in the OwnerRez WordPress plugin up to version 1.2.1 allows authenticated attackers with low-level privileges to inject malicious web scripts. When an administrator or other user views the affected page, the script executes in their browser, potentially leading to session hijacking, defacement, or phishing. No active exploitation or public exploit is currently known, and the vulnerability carries a low EPSS score (0.03%), indicating minimal immediate threat.
Arbitrary file upload vulnerability in the Bulk Featured Image WordPress plugin (versions up to 1.2.1) allows authenticated attackers with high privileges to upload malicious files, such as web shells, leading to remote code execution on the server. The flaw has a CVSS score of 9.1 due to an unrestricted file upload mechanism; however, no active exploitation has been confirmed and the EPSS exploitation probability is very low (0.07%).
Stored cross-site scripting in N-Media Frontend File Manager plugin for WordPress (≤23.2) allows authenticated, low-privileged users to inject script tags into filenames or content. An attacker with upload permissions can craft a malicious file that, when rendered in the frontend manager interface, executes arbitrary JavaScript in the browser of any user who views it. No public exploit or active exploitation has been observed; the EPSS score is very low at 0.03%.
Stored cross-site scripting in bPlugins Video Gallery Block plugin for WordPress allows authenticated attackers to inject malicious scripts that execute in the browsers of other users, including administrators. Versions up to 1.1.0 are affected. No public exploit or active exploitation reported; EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting in WP fancybox plugin through version 1.0.4 allows authenticated attackers to inject malicious scripts into pages viewed by other users. No known public exploit or active exploitation has been identified, and EPSS indicates low exploitation likelihood.
DOM-based cross-site scripting in the (Simply) Guest Author Name WordPress plugin through version 4.36 allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When an administrator or other high-privileged user views a page containing the malicious payload, the script executes in their browser, potentially leading to session theft, defacement, or unauthorized actions. No active exploitation or public proof-of-concept is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the MyRewards WordPress plugin up to 5.4.13.1 allows unauthenticated attackers to inject scripts that execute in other users' browsers, potentially leaking sensitive session information (CVSS 5.3). No active exploitation or public exploit is known, and EPSS shows very low exploitation probability (0.03%).
SQL injection vulnerability in the All In One Slider Responsive WordPress plugin allows unauthenticated attackers to read sensitive data from the database. The flaw affects all versions through 3.7.9 and requires no special conditions. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.04%), indicating minimal real-world risk.
Stored cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver WordPress plugin through 1.0.11 allows authenticated users with low privileges to inject scripts that execute in administrative contexts, leading to availability impacts. No active exploitation or public exploit has been identified, and EPSS indicates a very low likelihood of widespread attacks.
Cross-site request forgery in the Contact Form 7 reCAPTCHA WordPress plugin (≤1.2.0) allows unauthenticated attackers to trick site administrators into performing actions like disabling reCAPTCHA integration. No active exploitation or public exploit code has been identified; EPSS indicates a 0.02% probability of exploitation.
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in the Smart Docs WordPress plugin allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'smartdocs_search' shortcode. Versions up to and including 1.1.0 are affected. No public exploit has been identified at the time of analysis, and the EPSS exploitation probability is low (0.03%), reducing immediate risk.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Cross-site request forgery in the WordPress Import CDN-Remote Images plugin versions up to 2.1.2 enables stored cross-site scripting attacks through forged requests that bypass CSRF protections. An attacker can craft malicious requests to inject persistent JavaScript payloads into the plugin's configuration or imported content, affecting WordPress installations running vulnerable versions of the plugin. The vulnerability carries low exploitation probability (EPSS 0.02%) and no public exploit code has been identified.
Missing authorization controls in the Real Estate Property 2024 Create Your Own Fields and Search Bar WordPress plugin (versions up to 4.48) permit unauthenticated or low-privileged users to access functionality and data intended for higher privilege levels. The vulnerability stems from inadequately configured access control checks on plugin endpoints, allowing attackers to bypass intended security boundaries. With an EPSS score of 0.05% (17th percentile), real-world exploitation risk is minimal, and no public exploit code or active exploitation has been identified.
Arbitrary file movement in HT Contact Form Widget for Elementor & Gutenberg (WordPress plugin) allows unanatuhenticated remote attackers to relocate server files including wp-config.php, enabling remote code execution. Affects all versions through 2.2.1. Vulnerability stems from insufficient path validation in handle_files_upload() function. No public exploit identified at time of analysis, low observed exploitation activity.
Arbitrary file deletion in HT Contact Form Widget For Elementor (WordPress plugin) allows unanetworks attackers to remove critical server files, enabling remote code execution. Affecting all versions through 2.2.1, the vulnerability stems from insufficient path validation in temp_file_delete(), permitting deletion of wp-config.php or other essential files. CVSS 9.1 (Critical) with network attack vector, low complexity, and no authentication required. Vendor patch available (changeset 3326887). No public exploit identified at time of analysis, though the attack path is straightforward for skilled adversaries.
Unauthenticated remote code execution in HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks plugin (all versions ≤2.2.1) allows attackers to upload arbitrary files to the WordPress server. Missing file type validation in temp_file_upload() function enables unrestricted file uploads, permitting execution of malicious scripts. Critical severity (CVSS 9.8) due to network-accessible attack vector requiring no authentication or user interaction. No public exploit identified at time of analysis.
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
The Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and restore-info.json. Unauthenticated attackers can discover and download complete site backups containing the database, wp-config.php with credentials, and all uploaded files.
The Friends plugin for WordPress versions up to 3.5.1 contains a PHP Object Injection vulnerability in the query_vars parameter that allows authenticated subscribers and above to inject malicious serialized objects through unsafe deserialization. While the plugin itself lacks a known gadget chain (POP chain), successful exploitation depends on the presence of vulnerable code in other installed plugins or themes; if such a chain exists, attackers can achieve arbitrary file deletion, data exfiltration, or remote code execution, but exploitation requires knowledge of the site's SALT_NONCE and SALT_KEY values.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upload_handle() function due to missing file type validation, allowing unauthenticated attackers to upload malicious files and potentially achieve remote code execution. With a CVSS score of 9.8, network-accessible attack vector, and no authentication requirement, this vulnerability poses an immediate and severe threat to any WordPress installation using the affected plugin.
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
A SSRF vulnerability in for WordPress is vulnerable to Server-Side Request Forgery in all (CVSS 7.2). High severity vulnerability requiring prompt remediation. Vendor patch is available.
The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 61.0% and no vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36848. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.0% and no vendor patch available.
The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
The Lightbox & Modal Popup WordPress Plugin - FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Essential Addons for Elementor - Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin up to version 3.4.1 allows remote attackers to execute arbitrary SQL commands, primarily compromising database confidentiality. While rated Critical (CVSS 9.3) with a network attack vector, the EPSS probability of exploitation is only 0.04%, and no public exploits or active exploitation have been reported.
Unauthenticated SQL injection in the WordPress plugin Video List Manager through version 1.7 allows remote attackers to execute arbitrary SQL commands on the backing database, leading to exposure of sensitive data and potential partial denial of service. No authentication or user interaction is required, and the attack vector is network-accessible, but the EPSS exploitation probability is very low (0.04%), and no active exploitation or public exploit code is known at this time.
Blind SQL injection in bSecure – Your Universal Checkout WordPress plugin allows unauthenticated remote attackers to exfiltrate sensitive database contents, including user credentials and order data, via crafted HTTP requests to the checkout endpoint. The vulnerability affects all plugin versions up to 1.7.9 and requires no user interaction or special privileges. While no active exploitation or public exploit is currently known (EPSS 0.04%, not listed in CISA KEV), the CVSS 9.3 critical score reflects the high ease of exploitation and severe confidentiality impact across a changed scope, making patching a high priority.
A security vulnerability in Missing Authorization vulnerability in pietro MobiLoud (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in the Leyka WordPress plugin through version 3.31.9 allows unauthenticated attackers with no privileges to include and execute arbitrary PHP files on the server, potentially leading to full site compromise. Exploitation requires user interaction (tricking an administrator to click a malicious link) and achieves high impact on confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in the JobSearch WordPress plugin (through version 2.9.0) allows unauthenticated attackers to inject web scripts by tricking a user into clicking a crafted link. The vulnerability could lead to cookie theft, session hijacking, or defacement, though EPSS predicts very low exploitation likelihood (0.03%) and no public exploit or active exploitation is known.
Reflected cross-site scripting in the WP-Recall WordPress plugin up to version 16.26.14 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. No public exploit or active exploitation is confirmed; the vulnerability has a low EPSS score of 0.03%.
Stored cross-site scripting in the Video List Manager WordPress plugin up to version 1.7 enables unauthenticated attackers to inject malicious scripts that execute in the browsers of users viewing affected pages, potentially leading to credential theft, session hijacking, or site defacement. No active exploitation has been reported, and EPSS score of 0.03% indicates a low probability of widespread exploitation in the wild. Exploitation requires user interaction, as the victim must visit the compromised page.
A security vulnerability in Missing Authorization vulnerability in vgwort VG WORT METIS (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A security vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Unauthenticated SQL injection in the Cozmoslabs Paid Member Subscriptions WordPress plugin up to version 2.15.1 allows remote attackers with no privileges to execute arbitrary SQL commands via a specially crafted request. Successful exploitation can expose highly sensitive data from the database, with a low but possible impact on availability. The vulnerability carries a CVSS base score of 7.5 (High), an EPSS score of 0.03% indicating very low exploitation likelihood, and no known public exploit or active attacks at the time of analysis.
Reflected cross-site scripting in the Beautiful Cookie Consent Banner WordPress plugin (versions through 4.6.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL. Successful exploitation can lead to session token theft, credential harvesting, or malicious redirect depending on attacker-controlled payload. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.03% reflects low current exploitation probability.
Missing authorization in Gnuget MF Plus WPML plugin versions up to 1.1 allows unauthenticated attackers to modify settings. The vulnerability has a CVSS base score of 6.5, affecting integrity and availability without confidentiality impact, but no active exploitation is known and EPSS score (0.06%) indicates a low probability of real-world attacks.
Server-side request forgery in TeconceTheme Allmart 1.0.0 allows unauthenticated remote attackers to force the WordPress site to make requests to internal
Arbitrary file upload in the FW Gallery WordPress plugin (by Fastw3b LLC) affects all versions up to and including 8.0.0, letting remote attackers upload files of dangerous types (e.g. PHP webshells) with no authentication. Successful exploitation yields server-side code execution and full site compromise. It carries a maximum CVSS 3.1 base score of 10.0, but has no public exploit identified at time of analysis and a low EPSS of 0.07% (22nd percentile), and is not listed in CISA KEV.
Path traversal in DynamiApps Frontend Admin (WordPress plugin) up to version 3.28.7 allows an authenticated high-privileged attacker to read arbitrary files on the server, leading to exposure of sensitive information. No public exploit is known, and EPSS score suggests low exploitation likelihood.
Remote code execution in Easy Stripe WordPress plugin version 1.1 and earlier allows unauthenticated attackers to inject and execute arbitrary code on the underlying server. The vulnerability has a critical CVSS score of 10.0 but EPSS indicates a low exploitation probability (0.07%), and no active exploitation has been reported.
Reflected DOM-based cross-site scripting (XSS) in the WordPress Team Showcase plugin (versions prior to 25.05.13) allows unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged-in user or other site visitor clicks the link, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. No public exploit code or active exploitation has been reported, and the vendor has released patch version 25.05.13.
Reflected cross-site scripting in the Testimonials Showcase WordPress plugin through version 1.9.16 allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim user's browser session. An attacker can craft a malicious link that, when clicked by a user (any role) with an active WordPress session, will execute the attacker-supplied code, potentially stealing session tokens, defacing the page, or performing actions on the user's behalf. No active exploitation or public proof-of-concept is known at this time, and EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting vulnerability in the Booking Calendar Contact Form plugin for WordPress allows authenticated users with low privileges to inject arbitrary JavaScript into stored booking entries. When other users view these entries, the script executes, potentially leading to session theft or site defacement. No active exploitation or public exploit code has been identified, and the EPSS probability is very low (0.03%).
Unauthorized settings modification in WC Pickup Store (WordPress plugin by Keylor Mendoza) versions up to 1.8.9 allows unauthenticated attackers to alter plugin configuration, potentially disrupting pickup store operations. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS probability is very low (0.06%).
Local file inclusion in the PrivateContent - Mail Actions WordPress plugin allows unauthenticated attackers to include arbitrary local files, leading to potential remote code execution or sensitive data disclosure. Affects versions up to 2.3.2, with exploitation requiring user interaction and high attack complexity. No active exploitation or public exploit code has been reported as of this analysis.
A security vulnerability in Missing Authorization vulnerability in ashanjay EventON (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in AresIT WP Compress allows Authentication Abuse (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.
Authenticated SQL injection in the Simple Link Directory WordPress plugin up to version 14.7.3 allows low-privileged users to exfiltrate sensitive database contents. No public exploit or active exploitation has been confirmed, and the EPSS score of 0.04% indicates a very low likelihood of real-world attacks despite a CVSS 8.5 rating.
SQL injection in the Click & Pledge Connect WordPress plugin allows unauthenticated attackers to escalate privileges and potentially compromise affected sites. The vulnerability exists in versions 25.04010101 through WP6.8 and carries a critical CVSS score due to its full technical impact and easy exploitability, though no public exploit or active exploitation has been observed.
Path traversal leading to arbitrary file deletion in the Aviation Weather from NOAA WordPress plugin (versions through 0.7.2) allows an authenticated attacker to delete files outside the plugin's intended directory scope. The Patchstack advisory confirms the impact is arbitrary file deletion rather than disclosure, consistent with the CVSS vector showing A:H with C:N/I:N. Exploitation requires a low-privilege WordPress account, and no public exploit or active exploitation has been identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in the SB Breadcrumbs WordPress plugin up to version 1.0 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL, potentially hijacking user sessions, defacing the site, or redirecting visitors to malicious pages. No active exploitation or public exploit code has been identified at this time.
Stored cross-site scripting in the WebEmailProtector WordPress plugin (≤3.3.6) allows authenticated attackers with low-privilege accounts (e.g., Contributor) to inject malicious scripts into plugin settings, causing script execution in administrators' browsers. No public exploit or active exploitation has been reported, and EPSS probability is very low (0.03%).
Reflected cross-site scripting (XSS) in WP Wall ≤1.7.3 lets attackers execute arbitrary JavaScript in victims' browsers via crafted links. The WordPress plugin fails to properly sanitize reflected input, requiring user interaction. No active exploitation or public exploit is confirmed, and EPSS probability is very low (0.03%).
Reflected cross-site scripting in the OTWthemes Content Manager Light WordPress plugin through version 3.2 allows an unauthenticated attacker to inject arbitrary web scripts. Successful exploitation requires tricking an authenticated administrator into clicking a crafted link, after which the attacker may steal session tokens, deface content, or perform other actions in the victim’s browser context. At the time of analysis, no public exploit code or active exploitation has been identified.
Privilege escalation in Service Finder Booking plugin for WordPress allows unauthenticated attackers to gain full administrative control. This vulnerability, affecting all versions up to 6.0, arises from incorrect privilege assignment (CWE-266) and carries a CVSS score of 9.8, though EPSS indicates a low exploitation probability (0.08%) with no public exploit or active exploitation known.
Cross-Site Request Forgery in the Radio Station plugin for WordPress 2.5.12 and earlier allows unauthenticated attackers to perform actions on behalf of authenticated users if tricked into clicking a crafted link, leading to unauthorized changes with low integrity impact. The vulnerability is not known to be actively exploited, and no public exploit code has been identified.
Stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress versions up to 7.8 allows authenticated attackers with low privileges to inject malicious scripts into the statistics display pages. When an administrator views the affected page, the script executes in their browser, potentially leading to session hijacking, data theft, or administrative actions. Currently no public exploit or active exploitation has been reported, and the EPSS score is low (0.03%), indicating limited immediate risk.
DOM-based cross-site scripting in the WordPress Card flip image slideshow plugin (<= 1.5) allows authenticated attackers to execute arbitrary JavaScript in victims’ browsers. Exploitation requires at least contributor-level access and user interaction; impact includes session theft and defacement. No evidence of active exploitation or public exploit code exists, and EPSS indicates a very low probability of real-world attacks.
SQL injection in the gopiplus Pixelating image slideshow gallery WordPress plugin (versions ≤ 8.0) allows authenticated attackers with low privileges to execute arbitrary SQL queries, enabling unauthorized extraction of sensitive database information and potential disruption via costly queries. No public
Authenticated SQL injection in iFrame Images Gallery plugin up to version 9.0 allows any user with subscriber-level access to extract sensitive information from the WordPress database, including password hashes. No public exploit or active exploitation has been confirmed, and the EPSS score is extremely low (0.04%), indicating minimal real-world exploitation activity at this time.
Blind SQL injection in the Cool fade popup WordPress plugin allows authenticated low-privilege attackers to extract sensitive data from the database. The vulnerability affects all versions up to 10.1. Exploitation requires only subscriber-level access and no user interaction, making it easily exploitable once authenticated, though EPSS score is low (0.04%) and no public exploit or active exploitation is known.
DOM-based Cross-Site Scripting (XSS) in Aakif Kadiwala Posts Slider Shortcode plugin for WordPress up to version 1.0 allows authenticated attackers with low-level privileges to execute arbitrary scripts in the browsers of site visitors who view a vulnerable page. Exploitation could lead to session hijacking, defacement, or redirection. No active exploitation is confirmed, and EPSS estimates only a 0.03% probability of widespread exploitation, indicating low real-world risk despite the medium CVSS score.
A security vulnerability in Missing Authorization vulnerability in amazewp fluXtore (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization check in LMSACE Connect plugin for WordPress up to version 3.4 allows authenticated low‑privilege users to bypass access controls and modify plugin data. No public exploit code or active exploitation is known, and EPSS stands at 0.04%, indicating very low immediate risk.
Stored cross-site
SQL injection in the cybio Gallery Widget plugin for WordPress up to version 1.2.1 allows authenticated attackers with low privileges (e.g., Subscriber) to extract sensitive database information and cause limited availability disruptions. No active exploitation or public exploit is known, and the EPSS exploitation probability is very low (0.04%).
SQL injection in the Contact Us page – Contact people LITE WordPress plugin allows authenticated low-privileged users to extract sensitive data from the WordPress database. Versions through 3.7.4 are affected; an attacker needs a valid subscriber-level (or higher) account to exploit it. EPSS probability is very low, and no active exploitation or public exploit code has been identified.
Server-Side Request Forgery in Md Yeasin Ul Haider's URL Shortener WordPress plugin (≤3.0.7) allows unauthenticated attackers to force the server to make arbitrary requests, potentially accessing internal resources. The attack has high complexity and limited impact on confidentiality and integrity. No active exploitation is reported, and EPSS exploitation probability is very low (0.03%).
Stored cross-site scripting (XSS) in the OwnerRez WordPress plugin up to version 1.2.1 allows authenticated attackers with low-level privileges to inject malicious web scripts. When an administrator or other user views the affected page, the script executes in their browser, potentially leading to session hijacking, defacement, or phishing. No active exploitation or public exploit is currently known, and the vulnerability carries a low EPSS score (0.03%), indicating minimal immediate threat.
Arbitrary file upload vulnerability in the Bulk Featured Image WordPress plugin (versions up to 1.2.1) allows authenticated attackers with high privileges to upload malicious files, such as web shells, leading to remote code execution on the server. The flaw has a CVSS score of 9.1 due to an unrestricted file upload mechanism; however, no active exploitation has been confirmed and the EPSS exploitation probability is very low (0.07%).
Stored cross-site scripting in N-Media Frontend File Manager plugin for WordPress (≤23.2) allows authenticated, low-privileged users to inject script tags into filenames or content. An attacker with upload permissions can craft a malicious file that, when rendered in the frontend manager interface, executes arbitrary JavaScript in the browser of any user who views it. No public exploit or active exploitation has been observed; the EPSS score is very low at 0.03%.
Stored cross-site scripting in bPlugins Video Gallery Block plugin for WordPress allows authenticated attackers to inject malicious scripts that execute in the browsers of other users, including administrators. Versions up to 1.1.0 are affected. No public exploit or active exploitation reported; EPSS indicates very low exploitation probability (0.03%).
Stored cross-site scripting in WP fancybox plugin through version 1.0.4 allows authenticated attackers to inject malicious scripts into pages viewed by other users. No known public exploit or active exploitation has been identified, and EPSS indicates low exploitation likelihood.
DOM-based cross-site scripting in the (Simply) Guest Author Name WordPress plugin through version 4.36 allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When an administrator or other high-privileged user views a page containing the malicious payload, the script executes in their browser, potentially leading to session theft, defacement, or unauthorized actions. No active exploitation or public proof-of-concept is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the MyRewards WordPress plugin up to 5.4.13.1 allows unauthenticated attackers to inject scripts that execute in other users' browsers, potentially leaking sensitive session information (CVSS 5.3). No active exploitation or public exploit is known, and EPSS shows very low exploitation probability (0.03%).
SQL injection vulnerability in the All In One Slider Responsive WordPress plugin allows unauthenticated attackers to read sensitive data from the database. The flaw affects all versions through 3.7.9 and requires no special conditions. No active exploitation or public exploit code has been identified, and the EPSS score is low (0.04%), indicating minimal real-world risk.
Stored cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver WordPress plugin through 1.0.11 allows authenticated users with low privileges to inject scripts that execute in administrative contexts, leading to availability impacts. No active exploitation or public exploit has been identified, and EPSS indicates a very low likelihood of widespread attacks.
Cross-site request forgery in the Contact Form 7 reCAPTCHA WordPress plugin (≤1.2.0) allows unauthenticated attackers to trick site administrators into performing actions like disabling reCAPTCHA integration. No active exploitation or public exploit code has been identified; EPSS indicates a 0.02% probability of exploitation.
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Stored cross-site scripting in the Smart Docs WordPress plugin allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'smartdocs_search' shortcode. Versions up to and including 1.1.0 are affected. No public exploit has been identified at the time of analysis, and the EPSS exploitation probability is low (0.03%), reducing immediate risk.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.