Wordpress Plugin
Monthly
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Authenticated arbitrary file upload in the Download Plugin for WordPress ≤2.2.8 allows Administrator-level users to upload arbitrary files due to missing file type validation in the dpwap_plugin_locInstall function, leading to remote code execution. Publicly available exploit code exists, though EPSS indicates a low probability of widespread exploitation. No active exploitation has been confirmed by CISA KEV.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Arbitrary file upload vulnerability in AiBud WP plugin for WordPress versions up to 1.8.5 allows authenticated attackers with high privileges to upload web shells, leading to remote code execution on the web server. Proof-of-concept exploit code is publicly available, but no active exploitation is confirmed (not in CISA KEV) and EPSS indicates low exploitation probability.
The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Stored cross-site scripting (XSS) in the PublishPress Gutenberg Blocks WordPress plugin (up to version 3.3.1) allows authenticated attackers with low privileges to inject arbitrary JavaScript via specially crafted blocks. When an administrator or other user views the malicious content, the script executes in their browser, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified.
In Melapress File Monitor plugin for WordPress before 2.2.0, missing authorization checks allow authenticated attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of integrity or availability of monitored data. The vulnerability carries a CVSS 3.1 base score of 5.4 (medium) and has a low EPSS exploitation probability (0.06%), with no known active exploitation or public exploit code. A vendor patch in version 2.2.0 addresses the issue.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
Missing authorization in The Plus Addons for Elementor Pro allows authenticated attackers to manipulate access controls, leading to data modification and service disruption. Versions prior to 6.3.7 are affected. No known active exploitation or public exploit exists, and the EPSS probability is very low (0.06%).
Authenticated code injection in the Custom Login and Signup Widget WordPress plugin allows an attacker with administrative privileges to execute arbitrary code. The vulnerability affects all versions up to and including 1.0, enabling full site compromise through crafted PHP input in the plugin settings. Public exploit code is available, though EPSS indicates a low probability of widespread exploitation due to the high privilege requirement.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The MicroPayments - Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP VR - 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in devnex Devnex Addons For Elementor allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Cross-site request forgery in the Aioseo Multibyte Descriptions WordPress plugin (versions up to 0.0.6) allows unauthenticated attackers to perform state-changing actions on behalf of a logged-in administrator, such as altering plugin settings, by tricking them into clicking a malicious link. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported; EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting in the WordPress plugin Beauty Contact Popup Form up to version 6.0 enables authenticated attackers with high privileges to inject malicious scripts that execute when other users view stored contact form data. This issue has a medium CVSS score and low EPSS exploitation probability, with no known active exploitation or public exploit code.
A security vulnerability in Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Sensitive information exposure in the Accept Authorize.NET Payments WordPress plugin up to version 2.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from sent form submissions. The vulnerability has a CVSS base score of 5.3 with low confidentiality impact and requires no user interaction, but there is no evidence of public exploit code or active exploitation; EPSS probability is very low (0.06%).
DOM-based cross-site scripting in the WordPress Raise The Money plugin allows authenticated attackers with low privileges to inject malicious scripts, leading to code execution in victims' browsers. No active exploitation or public exploit code has been observed, and EPSS predicts a 0.04% chance of exploitation, indicating very low real-world risk.
Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.
Insufficient access controls in the WPManiax WP DB Booster plugin for WordPress up to version 1.0.1 allow authenticated low-privilege users to read sensitive data and cause limited availability impact. No public exploit or active exploitation has been identified. The vulnerability carries a medium-severity CVSS base score of 5.4 and a very low EPSS exploitation probability (0.07%).
Stored Cross-Site
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Unauthenticated exposure of sensitive data in Accept Stripe Payments Using Contact Form 7 plugin up to version 3.0 sends embedded secrets (e.g., API keys) in network traffic, allowing remote attackers to retrieve that data. The vulnerability stems from insertion of sensitive information into sent data, with a CVSS 5.3 base score. No active exploitation or public proof-of-concept has been identified at this time, and the EPSS exploitation probability is very low (0.06%).
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Authenticated SQL injection exists in the WP Forum Server WordPress plugin up to version 1.8.2, enabling high-privileged attackers (administrators) to read arbitrary data from the database. Exploitation requires administrative access and results in high confidentiality impact; no active exploitation or public exploit is known, and EPSS indicates a very low probability of widespread use.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
CVE-2025-53304 is a security vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.
Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.
Arbitrary file read vulnerability in the Plugin Inspector WordPress plugin up to version 1.5 allows authenticated administrators to read arbitrary files on the server via a path traversal attack. The vulnerability requires high privileges but can expose sensitive configuration and data. No active exploitation or public exploit code has been observed, and the EPSS score indicates a low probability of widespread exploitation.
Stored cross-site scripting in the EC Stars Rating WordPress plugin (versions ≤1.0.11) allows authenticated administrators to inject malicious scripts that execute in the browsers of other users who view the affected rating page. This could lead to session hijacking, defacement, or other browser-based attacks.
A security vulnerability in Missing Authorization vulnerability in iCount iCount Payment Gateway (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.
Unauthorized modification of dashboard widget sidebars in WordPress plugin Dashboard Widget Sidebar ≤1.2.3 allows authenticated users with low privileges to alter sidebar configurations. This missing authorization check permits exploitation of incorrectly configured access controls, leading to limited data integrity impact. No active exploitation or public exploit is known; EPSS probability is very low (0.05%).
DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.
Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).
Missing authorization in PlatiOnline Payments plugin for WordPress up to 6.3.2 allows authenticated attackers with low privileges to modify payment-related data. The vulnerability, stemming from broken access control, impacts only integrity (CVSS 4.3). No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the Quick Favicon WordPress plugin ≤0.22.8 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when another user views an affected page. No known public exploit or active exploitation has been reported, and EPSS indicates a very low probability of widespread use.
Stored cross-site scripting (XSS) in the Affiliate Links for Amazon WordPress plugin (versions up to 1.0.6) allows an authenticated attacker with high privileges to inject arbitrary scripts that execute when another user views the affected page. No public exploit or active exploitation has been identified, and the EPSS score indicates very low exploitation probability (0.04%).
A security vulnerability in pankaj (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).
Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).
DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).
Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Cross-site request forgery in the Slickstream WordPress plugin up to version 2.0.3 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as altering plugin settings. The vulnerability requires user interaction and has a low integrity impact. No active exploitation or public exploit code has been reported, and EPSS indicates a very low chance of real-world exploitation.
Cross-Site Request Forgery (CSRF) in the opicron Image Cleanup WordPress plugin (versions up to 1.9.2) allows unauthenticated attackers to trick authenticated administrators into performing unauthorized actions on the affected site. The vulnerability carries a CVSS base score of 4.3 (Medium) with low integrity impact only, and no public exploit or active exploitation has been observed.
Cross-Site Request Forgery (CSRF) in the My Wp Brand WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions on the plugin’s settings. Affected versions up to 1.1.3 lack proper request origin verification, enabling state-changing operations with only low integrity impact. No active exploitation or public exploit code is known, and EPSS rates exploitation probability as very low (0.02%).
Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Low-privileged authenticated users can bypass authorization checks in the Cron Logger WordPress plugin up to version 1.3.0, leading to limited service disruption. The flaw allows attackers with subscriber-level or similar low access to cause availability impact without any interaction. No evidence of active exploitation or public exploit code exists.
Unauthenticated cross-site request forgery in the Virusdie WordPress plugin through version 1.1.3 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying plugin settings or triggering scans. Exploitation requires user interaction and no public exploit or active exploitation has been identified; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
Cross-site request forgery (CSRF) vulnerability in the Address Autocomplete via Google for Gravity Forms WordPress plugin allows attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying plugin settings. The flaw affects plugin versions through 1.3.4 and requires user interaction (admin clicking a link). No public exploit or active exploitation has been identified; EPSS score is low (0.02%).
Cross-site request forgery in the Writesonic WordPress plugin through version 1.0.4 enables attackers to trick administrators into unknowingly triggering actions such as modifying plugin settings or disrupting service. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.02% probability of exploitation.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
A security vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Authenticated arbitrary file upload in the Download Plugin for WordPress ≤2.2.8 allows Administrator-level users to upload arbitrary files due to missing file type validation in the dpwap_plugin_locInstall function, leading to remote code execution. Publicly available exploit code exists, though EPSS indicates a low probability of widespread exploitation. No active exploitation has been confirmed by CISA KEV.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Arbitrary file upload vulnerability in AiBud WP plugin for WordPress versions up to 1.8.5 allows authenticated attackers with high privileges to upload web shells, leading to remote code execution on the web server. Proof-of-concept exploit code is publicly available, but no active exploitation is confirmed (not in CISA KEV) and EPSS indicates low exploitation probability.
The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Stored cross-site scripting (XSS) in the PublishPress Gutenberg Blocks WordPress plugin (up to version 3.3.1) allows authenticated attackers with low privileges to inject arbitrary JavaScript via specially crafted blocks. When an administrator or other user views the malicious content, the script executes in their browser, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified.
In Melapress File Monitor plugin for WordPress before 2.2.0, missing authorization checks allow authenticated attackers to exploit incorrectly configured access control, potentially leading to unauthorized modification of integrity or availability of monitored data. The vulnerability carries a CVSS 3.1 base score of 5.4 (medium) and has a low EPSS exploitation probability (0.06%), with no known active exploitation or public exploit code. A vendor patch in version 2.2.0 addresses the issue.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Stored cross-site scripting in Magic Buttons for Elementor WordPress plugin versions ≤1.0 allows authenticated attackers with Contributor-level access to inject arbitrary scripts via the magic-button shortcode, executing in the browsers of any user viewing the affected page. No active exploitation or public exploit code is known, and EPSS probability is extremely low (0.03%).
Stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the magic-button shortcode. The flaw exists in all versions up to and including 1.0 due to insufficient input sanitization. No public exploit has been identified, and EPSS score is very low (0.03%), indicating minimal exploitation risk at this time.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
Missing authorization in The Plus Addons for Elementor Pro allows authenticated attackers to manipulate access controls, leading to data modification and service disruption. Versions prior to 6.3.7 are affected. No known active exploitation or public exploit exists, and the EPSS probability is very low (0.06%).
Authenticated code injection in the Custom Login and Signup Widget WordPress plugin allows an attacker with administrative privileges to execute arbitrary code. The vulnerability affects all versions up to and including 1.0, enabling full site compromise through crafted PHP input in the plugin settings. Public exploit code is available, though EPSS indicates a low probability of widespread exploitation due to the high privilege requirement.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The MicroPayments - Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP VR - 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in devnex Devnex Addons For Elementor allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Stored XSS via cross-site request forgery in the re.place WordPress plugin allows an attacker to store malicious scripts by tricking a logged-in administrator into clicking a crafted link. The vulnerability affects versions up to 0.2.1, and no active exploitation or public exploit code has been identified at the time of analysis.
Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.
Stored Cross-Site Scripting (XSS) in the RSS Digest WordPress plugin (versions up to 1.5) can be exploited via Cross-Site Request Forgery (CSRF), allowing unauthenticated attackers to trick site administrators into performing actions that inject malicious scripts. The injected payload persists and executes in the browsers of other users, leading to content manipulation, session theft, or site defacement. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability.
Cross-site request forgery in the Społecznościowa 6 PL 2013 WordPress plugin (versions <= 2.0.6) allows unauthenticated attackers to trick an administrator into executing unintended actions, leading to stored cross-site scripting. This enables injection of malicious scripts that execute in the browsers of other users, potentially stealing session cookies, defacing the site, or redirecting visitors. No active exploitation is confirmed, and the EPSS score is very low (0.02%).
Cross-site request forgery in the Aioseo Multibyte Descriptions WordPress plugin (versions up to 0.0.6) allows unauthenticated attackers to perform state-changing actions on behalf of a logged-in administrator, such as altering plugin settings, by tricking them into clicking a malicious link. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported; EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting in the WordPress plugin Beauty Contact Popup Form up to version 6.0 enables authenticated attackers with high privileges to inject malicious scripts that execute when other users view stored contact form data. This issue has a medium CVSS score and low EPSS exploitation probability, with no known active exploitation or public exploit code.
A security vulnerability in Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Sensitive information exposure in the Accept Authorize.NET Payments WordPress plugin up to version 2.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from sent form submissions. The vulnerability has a CVSS base score of 5.3 with low confidentiality impact and requires no user interaction, but there is no evidence of public exploit code or active exploitation; EPSS probability is very low (0.06%).
DOM-based cross-site scripting in the WordPress Raise The Money plugin allows authenticated attackers with low privileges to inject malicious scripts, leading to code execution in victims' browsers. No active exploitation or public exploit code has been observed, and EPSS predicts a 0.04% chance of exploitation, indicating very low real-world risk.
Cross-site scripting in Free Downloads EDD WordPress plugin allows DOM-based XSS attacks against authenticated users with low privileges, potentially leading to session hijacking or malicious actions. The vulnerability affects versions up to 1.0.4 and has a low exploitation likelihood (EPSS 0.04%) with no public exploit or active exploitation reported.
Insufficient access controls in the WPManiax WP DB Booster plugin for WordPress up to version 1.0.1 allow authenticated low-privilege users to read sensitive data and cause limited availability impact. No public exploit or active exploitation has been identified. The vulnerability carries a medium-severity CVSS base score of 5.4 and a very low EPSS exploitation probability (0.07%).
Stored cross-site scripting (XSS) via cross-site request forgery (CSRF) in the Relocate Upload WordPress plugin up to version 0.24.1 allows an unauthenticated attacker to inject malicious scripts into the administrative interface. The attack requires an authenticated administrator to be tricked into clicking a crafted link, after which the injected script executes in the context of the admin user. No active exploitation or public exploit code has been identified, and EPSS data indicates a very low exploitation probability (0.02%).
SQL injection via Cross-Site Request Forgery in the sh1zen WP Optimizer WordPress plugin (all versions through 2.3.6) lets a remote attacker who lures a logged-in privileged user into visiting a malicious page forge a state-changing request that reaches an unsanitized SQL query. Rated CVSS 9.6 with a scope change, it can compromise the WordPress database, but exploitation hinges on user interaction and there is no public exploit and a negligible EPSS of 0.03%.
Stored cross-site scripting (XSS) in the WordPress Twitch TV Embed Suite plugin allows attackers to inject malicious scripts. The vulnerability is reachable via a cross-site request forgery (CSRF) attack against authenticated administrators, affecting all plugin versions up to and including 2.1.0. No active exploitation or public exploit code has been confirmed, and the EPSS score is very low.
Stored cross-site scripting via cross-site request forgery in the OnionBuzz WordPress plugin (<=1.0.7) allows remote attackers to inject malicious scripts that execute in an administrator's browser when they are tricked into clicking a crafted link. The attack requires no authentication from the attacker, but does depend on user interaction. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Cross-site request forgery in the Navayan Subscribe WordPress plugin allows unauthenticated attackers to inject persistent cross-site scripting payloads via crafted requests. Exploitation requires an authenticated administrator to click a malicious link, whereupon arbitrary JavaScript executes in the administrator’s browser, potentially leading to session theft, data manipulation, or further compromise. No active exploitation or public exploit code has been identified; EPSS indicates a low probability of broad exploitation.
Reflected XSS vulnerability in WordPress
Unauthenticated exposure of sensitive data in Accept Stripe Payments Using Contact Form 7 plugin up to version 3.0 sends embedded secrets (e.g., API keys) in network traffic, allowing remote attackers to retrieve that data. The vulnerability stems from insertion of sensitive information into sent data, with a CVSS 5.3 base score. No active exploitation or public proof-of-concept has been identified at this time, and the EPSS exploitation probability is very low (0.06%).
Cross-site request forgery (CSRF) in the Image Slider With Description WordPress plugin up to version 9.2 enables stored cross-site scripting (XSS) attacks. An unauthenticated attacker can trick a site administrator into submitting a malicious request, leading to the injection of arbitrary web scripts that execute when a victim visits the affected page. The low EPSS score (0.02%) and absence from CISA KEV suggest no active exploitation, but the issue can compromise site integrity and user data.
Authenticated SQL injection exists in the WP Forum Server WordPress plugin up to version 1.8.2, enabling high-privileged attackers (administrators) to read arbitrary data from the database. Exploitation requires administrative access and results in high confidentiality impact; no active exploitation or public exploit is known, and EPSS indicates a very low probability of widespread use.
Cross-site request forgery in the WP Forum Server WordPress plugin (up to 1.8.2) enables unauthenticated attackers to inject stored cross-site scripting (XSS) by tricking logged-in administrators into clicking a malicious link. Successful exploitation can lead to session hijacking or full
CVE-2025-53304 is a security vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
DOM-Based Cross-Site Scripting in the Theme Junkie Team Content WordPress plugin (versions through 0.1.1) allows a low-privileged authenticated attacker to inject malicious scripts that execute in the browser of any user who views the affected page. Because the scope changes (S:C in the CVSS vector), the injected script can access session cookies and perform actions on behalf of higher-privileged users such as administrators. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.04% reflects very low observed exploitation probability.
Stored cross-site scripting in the WordPress Podcast Feed Player Widget and Shortcode plugin up to version 2.2.0 allows authenticated contributors to inject arbitrary JavaScript through shortcode or widget inputs. When an administrator views the affected page, the script executes in the admin's browser context, enabling session theft or actions on behalf of the admin. No evidence of active exploitation (CISA KEV not listed) and EPSS score is low (0.04%), reducing immediate priority.
Arbitrary file read vulnerability in the Plugin Inspector WordPress plugin up to version 1.5 allows authenticated administrators to read arbitrary files on the server via a path traversal attack. The vulnerability requires high privileges but can expose sensitive configuration and data. No active exploitation or public exploit code has been observed, and the EPSS score indicates a low probability of widespread exploitation.
Stored cross-site scripting in the EC Stars Rating WordPress plugin (versions ≤1.0.11) allows authenticated administrators to inject malicious scripts that execute in the browsers of other users who view the affected rating page. This could lead to session hijacking, defacement, or other browser-based attacks.
A security vulnerability in Missing Authorization vulnerability in iCount iCount Payment Gateway (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in the Smart Agenda WordPress plugin up to version 4.9 allows authenticated attackers with low-privilege accounts to inject malicious scripts that execute in the browsers of users viewing the compromised content. No known public exploit or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.04% indicates a very low probability of exploitation in the wild.
Unauthorized modification of dashboard widget sidebars in WordPress plugin Dashboard Widget Sidebar ≤1.2.3 allows authenticated users with low privileges to alter sidebar configurations. This missing authorization check permits exploitation of incorrectly configured access controls, leading to limited data integrity impact. No active exploitation or public exploit is known; EPSS probability is very low (0.05%).
DOM-based XSS in the WP DataTable WordPress plugin (versions up to and including 0.2.7) allows a low-privileged authenticated attacker to inject malicious client-side scripts that execute in a victim's browser session. The flaw is classified under CWE-79 and arises from insufficient input neutralization in a DOM manipulation path, meaning the payload is processed by the browser rather than the server. No public exploit code and no CISA KEV listing have been identified at the time of analysis; EPSS at 0.04% reflects a low near-term exploitation probability.
Stored cross-site scripting in the WordPress plugin WP Visual Sitemap up to version 1.0.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into sitemap content. When an administrator or other privileged user views the affected content, the script executes in their browser, enabling session hijacking or site defacement. No public exploit or active exploitation is known, and EPSS probability is very low (0.04%).
Missing authorization in PlatiOnline Payments plugin for WordPress up to 6.3.2 allows authenticated attackers with low privileges to modify payment-related data. The vulnerability, stemming from broken access control, impacts only integrity (CVSS 4.3). No public exploit or active exploitation is known, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the Quick Favicon WordPress plugin ≤0.22.8 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when another user views an affected page. No known public exploit or active exploitation has been reported, and EPSS indicates a very low probability of widespread use.
Stored cross-site scripting (XSS) in the Affiliate Links for Amazon WordPress plugin (versions up to 1.0.6) allows an authenticated attacker with high privileges to inject arbitrary scripts that execute when another user views the affected page. No public exploit or active exploitation has been identified, and the EPSS score indicates very low exploitation probability (0.04%).
A security vulnerability in pankaj (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in WordPress Thumbnail Editor plugin ≤2.3.3 allows authenticated users with low privileges to inject arbitrary web scripts that execute when an administrator views the affected content, potentially leading to privilege escalation or data theft. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.04%).
Stored cross-site scripting in the Football Pool WordPress plugin (≤2.12.5) enables authenticated attackers to inject malicious scripts into pages viewed by other users. Successful exploitation requires user interaction to trigger the stored payload, leading to potential data theft or session compromise. EPSS indicates very low current exploitation probability (0.04%).
DOM-Based Cross-Site Scripting (XSS) in the Popup addon for Ninja Forms WordPress plugin up to version 3.4 allows authenticated attackers with at least contributor-level access to inject and execute arbitrary JavaScript in the browser of a victim who interacts with a crafted popup. Successful exploitation could lead to session hijacking, credential theft, or complete site takeover in the context of a higher-privileged user. No active exploitation or public exploit code is known at this time, and the EPSS exploitation probability is low (0.04%).
Stored Cross-Site Scripting in WP AdCenter plugin up to version 2.6.0 allows authenticated users with low-level privileges to inject malicious scripts into ad content, which execute in the browsers of administrators viewing the affected pages, potentially leading to session hijacking or privilege escalation. No active exploitation or public exploit code has been identified, and the EPSS score indicates a very low probability of widespread exploitation.
Object Injection via Cross-Site Request Forgery (CSRF) in Infigo Software IS-theme-companion WordPress plugin allows attackers to execute arbitrary code on affected websites when an authenticated administrator is tricked into clicking a malicious link. The vulnerability exists in versions up to and including 1.57 and can lead to full site compromise. No public exploit or active exploitation has been confirmed, and the EPSS probability of exploitation is very low (0.03%).
DOM-based Cross-Site Scripting (XSS) in the Omnipress WordPress plugin through version 1.6.3 allows authenticated attackers with low privileges (e.g., contributor accounts) to inject malicious scripts that execute in the browser of an administrator or other user. The vulnerability is triggered via crafted page content and requires victim interaction (e.g., visiting a page). No active exploitation or public proof-of-concept has been identified, and the EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting (XSS) vulnerability in the VaultDweller Leyka WordPress plugin (versions ≤3.31.9) allows authenticated attackers to inject arbitrary JavaScript into pages viewed by other users. Successful exploitation requires a low-privileged attacker account and user interaction, potentially leading to session hijacking or page manipulation. No active exploitation or public exploit code has been confirmed at this time.
Stored Cross-Site Scripting (XSS) can be achieved through Cross-Site Request Forgery (CSRF) in the WP Permalink Translator plugin for WordPress, affecting versions up to 1.7.6. An attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent script injection that executes in the browsers of other site visitors. EPSS predicts a very low exploitation probability (0.02%) and no active exploitation is confirmed.
Cross-site request forgery in the Slickstream WordPress plugin up to version 2.0.3 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as altering plugin settings. The vulnerability requires user interaction and has a low integrity impact. No active exploitation or public exploit code has been reported, and EPSS indicates a very low chance of real-world exploitation.
Cross-Site Request Forgery (CSRF) in the opicron Image Cleanup WordPress plugin (versions up to 1.9.2) allows unauthenticated attackers to trick authenticated administrators into performing unauthorized actions on the affected site. The vulnerability carries a CVSS base score of 4.3 (Medium) with low integrity impact only, and no public exploit or active exploitation has been observed.
Cross-Site Request Forgery (CSRF) in the My Wp Brand WordPress plugin allows attackers to trick authenticated administrators into performing unintended actions on the plugin’s settings. Affected versions up to 1.1.3 lack proper request origin verification, enabling state-changing operations with only low integrity impact. No active exploitation or public exploit code is known, and EPSS rates exploitation probability as very low (0.02%).
Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Low-privileged authenticated users can bypass authorization checks in the Cron Logger WordPress plugin up to version 1.3.0, leading to limited service disruption. The flaw allows attackers with subscriber-level or similar low access to cause availability impact without any interaction. No evidence of active exploitation or public exploit code exists.
Unauthenticated cross-site request forgery in the Virusdie WordPress plugin through version 1.1.3 allows remote attackers to trick authenticated administrators into performing unintended actions, such as modifying plugin settings or triggering scans. Exploitation requires user interaction and no public exploit or active exploitation has been identified; EPSS indicates a very low exploitation probability.
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
Cross-site request forgery (CSRF) vulnerability in the Address Autocomplete via Google for Gravity Forms WordPress plugin allows attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying plugin settings. The flaw affects plugin versions through 1.3.4 and requires user interaction (admin clicking a link). No public exploit or active exploitation has been identified; EPSS score is low (0.02%).
Cross-site request forgery in the Writesonic WordPress plugin through version 1.0.4 enables attackers to trick administrators into unknowingly triggering actions such as modifying plugin settings or disrupting service. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.02% probability of exploitation.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
A security vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion (CVSS 7.5). High severity vulnerability requiring prompt remediation.