Wordpress Plugin
Monthly
Authenticated SQL injection in the Wow-Company Hover Effects plugin for WordPress up to version 2.1.2 allows high-privilege attackers to extract sensitive information from the website database. The vulnerability requires administrative access to the plugin interface, but successful exploitation can fully compromise data confidentiality. No active exploitation or public exploit code has been identified at the time of analysis.
Local File Inclusion in the Gmedia Photo Gallery WordPress plugin (≤1.23.0) allows low-privileged authenticated attackers to include arbitrary local files on the server, potentially leading to sensitive data exposure or code execution. No active exploitation has been reported, and the EPSS exploitation probability is low (0.16%).
High-privilege SQL injection in the YaySMTP WordPress plugin (versions through 2.6.5) allows authenticated administrators to extract sensitive database information via network requests. No active exploitation or public exploit code has been identified, and EPSS predicts a low 0.05% chance of exploitation in the near term.
Missing authorization in the HurryTimer WordPress plugin through version 2.13.1 allows unauthenticated, remote attackers to modify plugin data (low integrity impact) with no user interaction. The vulnerability arises from incorrectly configured access controls, enabling unauthorized action via network requests. No active exploitation or public exploit code is confirmed, and EPSS probability is very low (0.06%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WP Edit WordPress plugin through version 4.0.4 allows authenticated attackers with high privileges (such as administrators) to inject arbitrary web scripts into pages. These scripts execute in the browsers of other users who later view the affected content, enabling session hijacking, defacement, or theft of sensitive data. No public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low current exploitation probability.
Information disclosure in Roland Beaussant Audio Editor & Recorder plugin for WordPress up to version 2.2.3 allows unauthenticated remote attackers to access sensitive system information. The vulnerability has a low exploitation probability (EPSS 0.06%) and no known public exploit code, but successful exploitation could leak embedded sensitive data.
Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.
DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.
Data manipulation in QuantumCloud ChatBot 6.7.3 and below allows authenticated low-privilege users to bypass missing authorization checks and modify plugin data. The vulnerability has a CVSS 3.1 base score of 4.3 (Medium) and an EPSS probability of 0.05%, indicating low exploitation likelihood. No active exploitation has been confirmed, and no public exploit code is available at time of analysis.
A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
SQL injection in DirectIQ Email Marketing plugin ≤2.0 for WordPress allows unauthenticated remote attackers to extract sensitive data from the underlying database. The vulnerability carries a CVSS 9.3 critical rating due to its network attack vector, low complexity, and lack of required privileges or user interaction. No public exploit or active exploitation has been confirmed, and EPSS likelihood is very low (0.05%).
Privilege escalation vulnerability in the MDJM Mobile DJ Manager WordPress plugin (versions ≤ 1.7.6) allows authenticated users to gain unauthorized access via missing authorization checks. A low-privilege attacker can exploit this to achieve full site compromise, with high impact on confidentiality, integrity, and availability. No active exploitation or public exploit code has been reported.
Unauthorized access to restricted whistleblowing data in the Trusty Whistleblowing WordPress plugin (≤1.5.2) allows remote, unauthenticated attackers to retrieve confidential reports via a missing authorization check. The vulnerability has no reported active exploitation or public exploit, but carries a CVSS score of 8.2 due to high confidentiality impact and low attack complexity. EPSS data indicates a 0.06% probability of exploitation in the wild, suggesting low immediate risk.
Unauthenticated missing authorization in the Abandoned Contact Form 7 WordPress plugin allows remote attackers to modify plugin data and cause a denial of service. The flaw affects versions up to 2.0 and stems from incorrectly configured access control levels, enabling any unauthenticated user to perform actions that should be restricted. The exploitation probability is low (EPSS 0.08%), and no active exploitation has been confirmed.
A security vulnerability in ovatheme BRW allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local File Inclusion in the National Weather Service Alerts WordPress plugin through version 1.3.5 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing sensitive configuration data or enabling further attacks like remote code execution via log poisoning. No public exploit or active exploitation has been reported, and EPSS indicates a low probability of exploitation (0.16%).
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Privilege escalation in the CouponXxL Custom Post Types WordPress plugin (version ≤3.0) allows unauthenticated attackers to gain higher-level permissions due to incorrect privilege assignment. No active exploitation or public exploit code is known; EPSS predicts a 0.08 % probability of exploitation activity.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Local File Inclusion in Zikzag Core WordPress plugin through version 1.4.5 allows unauthenticated attackers to include arbitrary local files, potentially leading to information disclosure or remote code execution. The vulnerability carries a CVSS score of 8.1 with high attack complexity, and no known public exploit or active exploitation has been identified at this time.
Unauthenticated arbitrary file upload in HaruTheme's "Drag and Drop Multiple File Upload (Pro) - WooCommerce" WordPress plugin (all versions up to and including 5.0.6) lets remote attackers upload executable PHP files (a web shell) directly to the web server, yielding full remote code execution. The flaw carries a maximum CVSS 3.1 base score of 10.0 (scope-changed, network, no privileges, no user interaction), reported by Patchstack. EPSS is low at 0.19% and there is no public exploit identified at time of analysis, but the trivial exploitability and RCE outcome make this a high-priority patch.
Arbitrary file deletion in the FW Food Menu WordPress plugin (≤6.0.0) allows remote attackers to delete server files, potentially causing service unavailability. Exploitation requires no authentication or user interaction, making it highly accessible. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.08%).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Local file inclusion in the FW Gallery WordPress plugin (versions up to 8.0.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data like configuration files. The high attack complexity suggests exploitation depends on specific server conditions, not default configurations. No public exploit or active exploitation has been confirmed at time of analysis.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Local file inclusion in CTUsers WordPress plugin up to 1.0.0 allows unauthenticated attackers to include arbitrary local files via a crafted request. Exploitation requires user interaction and high attack complexity, but can lead to full compromise of the affected server, including disclosure of sensitive data or code execution. The vulnerability is not known to be actively exploited and has a low EPSS probability score.
Missing authorization checks in the WPKit For Elementor WordPress plugin (versions ≤ 1.1.0) allow unauthenticated attackers to escalate privileges via crafted requests that modify arbitrary WordPress options. The vulnerability requires user interaction and can lead to privilege escalation without user awareness. No active exploitation is confirmed, and EPSS indicates a very low exploitation probability (0.09%).
Local file inclusion in the SERPed.net WordPress plugin (versions ≤4.6) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. No patch is available, and the plugin may be closed or abandoned. Exploitation risk is tempered by high attack complexity and a low EPSS score (0.16%), though successful exploitation yields full confidentiality, integrity, and availability impact.
Remote, unauthenticated code injection in the Content No Cache WordPress plugin allows attackers to execute arbitrary PHP functions, leading to high confidentiality impact. This vulnerability, rated CVSS 8.6, affects all versions up to 0.1.3 and can be exploited without user interaction to disclose sensitive data such as configuration files. While exploitation is technically straightforward, EPSS data suggests a low probability of active exploitation in the wild.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Object injection via unsafe deserialization in the WP Optimize By xTraffic WordPress plugin allows unauthenticated remote attackers to achieve code execution by sending crafted serialized data. All plugin versions up to and including 5.1.6 are affected. No active exploitation or public exploit code has been identified, and EPSS predicts only a 0.13% chance of exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Account takeover via authentication bypass in WP SmartPay plugin versions up to 2.7.13 allows authenticated low-privileged users to gain full administrative control of the WordPress site. By exploiting an alternate authentication channel, attackers can escalate privileges, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is known; EPSS is low at 0.07%.
Authenticated path traversal in the WordPress Image Shadow plugin up to version 1.1.0 allows low-privileged users to delete arbitrary files on the server, leading to a high availability impact. The vulnerability requires an authenticated attacker with minimal privileges and can be exploited over the network with low complexity. No active exploitation or public exploit code is known at this time, reflected by a very low EPSS score of 0.08%.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the admin-side AJAX endpoint ajax_get_table_data() returns those raw names as JSON column headers, and the client-side DataTables renderer injects them directly into the DOM without any HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in the Web Cam plugin for WordPress up to version 1.0 enables authenticated attackers (Contributor+) to inject arbitrary JavaScript via the slug parameter, affecting users who view injected pages. No active exploitation or public proof-of-concept has been identified, and EPSS indicates low exploitation probability (0.05%).
Stored cross-site scripting in the Namasha By Mdesign WordPress plugin allows authenticated attackers with Contributor-level access to inject JavaScript via the ‘playicon_title’ parameter. All plugin versions up to 1.2.00 are affected, enabling script execution when other users view the injected content. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability (0.04%).
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in the Event RSVP and Simple Event Management Plugin for WordPress up to 4.1.0 allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts via the 'emd_mb_meta' shortcode. Injected scripts execute whenever any user accesses a page containing the malicious shortcode, potentially leading to session hijacking or unauthorized actions. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.04%), indicating limited immediate risk.
The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Privilege escalation in the Simple User Registration plugin for WordPress up to version 6.3 allows unauthenticated attackers to register as administrators by sending crafted user meta values. A publicly available exploit exists, and the EPSS score of 29.28% indicates a high likelihood of exploitation, though it has not yet been added to CISA's Known Exploited Vulnerabilities catalog. Successful exploitation grants full control over the affected WordPress site.
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
The Everest Forms (Pro) WordPress plugin versions up to 1.9.4 contain an arbitrary file deletion vulnerability in the delete_entry_files() function due to insufficient path validation (CWE-36). Unauthenticated attackers can delete arbitrary files on the server by tricking an administrator into deleting a form entry, potentially leading to remote code execution through deletion of critical files like wp-config.php. This is a high-severity vulnerability (CVSS 7.5) that requires social engineering or admin interaction but can completely compromise WordPress installations.
The 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.
The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A privilege escalation vulnerability in Rameez Iqbal Real Estate Manager allows Privilege Escalation (CVSS 8.8). High severity vulnerability requiring prompt remediation.
CVE-2025-52822 is an SQL injection vulnerability in Iqonic Design's WP Roadmap WordPress plugin (versions up to 2.1.3) that allows authenticated attackers to execute arbitrary SQL commands. An attacker with user-level privileges can exploit this via network access without user interaction to read sensitive database contents and cause denial of service. The vulnerability has not been confirmed as actively exploited in the wild, but the high CVSS score (8.5) and low attack complexity indicate this should be treated as a priority for affected WordPress installations.
CVE-2025-52821 is a SQL Injection vulnerability in thanhtungtnt Video List Manager versions up to 1.7 that allows authenticated attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 8.5 with high confidentiality impact and cross-site scope implications, meaning successful exploitation could lead to unauthorized data access and potential lateral movement within affected systems. While the attack requires valid credentials (PR:L), the network accessibility and low attack complexity make this a significant risk for organizations using this plugin.
CVE-2025-52802 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
CVE-2025-52795 is a Cross-Site Request Forgery (CSRF) vulnerability in the aharonyan WP Front User Submit / Front Editor WordPress plugin (versions up to 4.9.4) that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a CVSS score of 7.1 with high availability impact, enabling attackers to modify or delete user-submitted content through malicious web requests without user consent.
CVE-2025-52794 is a Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form (versions up to 1.0.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads through contact form submissions, affecting any user who views the contaminated form data. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low attack complexity, making it readily exploitable in typical web deployments.
CVE-2025-52793 is a Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Settings that enables reflected Cross-Site Scripting (XSS) attacks. The vulnerability affects Esselink.nu Settings versions up to and including 2.94, allowing unauthenticated remote attackers to perform actions on behalf of users and inject malicious scripts with minimal user interaction. With a CVSS score of 7.1 and network-based attack vector, this vulnerability poses a moderate-to-significant risk to affected installations, particularly if actively exploited or if public proof-of-concept code becomes available.
CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the vgstef WP User Stylesheet Switcher WordPress plugin (versions up to v2.2.0) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a simple network request with user interaction to inject malicious scripts that execute in victims' browsers, potentially compromising user sessions and data. The vulnerability has not been confirmed as actively exploited in the wild, though the high CVSS score (7.1) and network-accessible attack vector indicate practical exploitability.
CVE-2025-52791 is a CSRF vulnerability in devfelixmoira Knowledge Base Maker (versions up to 1.1.8) that enables Stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can affect multiple users through stored payloads, with a CVSS score of 7.1 indicating medium-high severity. No KEV listing or confirmed EPSS data is available in public sources, and patch availability status requires verification with the vendor.
CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.
A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.
CVE-2025-52782 is a Reflected Cross-Site Scripting (XSS) vulnerability in King Rayhan Scroll UP WordPress plugin versions through 2.0 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction; attackers can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. KEV status and active exploitation data were not provided in available intelligence sources, though the reflected XSS nature suggests moderate real-world exploitability.
CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.
Authenticated SQL injection in the Wow-Company Hover Effects plugin for WordPress up to version 2.1.2 allows high-privilege attackers to extract sensitive information from the website database. The vulnerability requires administrative access to the plugin interface, but successful exploitation can fully compromise data confidentiality. No active exploitation or public exploit code has been identified at the time of analysis.
Local File Inclusion in the Gmedia Photo Gallery WordPress plugin (≤1.23.0) allows low-privileged authenticated attackers to include arbitrary local files on the server, potentially leading to sensitive data exposure or code execution. No active exploitation has been reported, and the EPSS exploitation probability is low (0.16%).
High-privilege SQL injection in the YaySMTP WordPress plugin (versions through 2.6.5) allows authenticated administrators to extract sensitive database information via network requests. No active exploitation or public exploit code has been identified, and EPSS predicts a low 0.05% chance of exploitation in the near term.
Missing authorization in the HurryTimer WordPress plugin through version 2.13.1 allows unauthenticated, remote attackers to modify plugin data (low integrity impact) with no user interaction. The vulnerability arises from incorrectly configured access controls, enabling unauthorized action via network requests. No active exploitation or public exploit code is confirmed, and EPSS probability is very low (0.06%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the WP Edit WordPress plugin through version 4.0.4 allows authenticated attackers with high privileges (such as administrators) to inject arbitrary web scripts into pages. These scripts execute in the browsers of other users who later view the affected content, enabling session hijacking, defacement, or theft of sensitive data. No public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low current exploitation probability.
Information disclosure in Roland Beaussant Audio Editor & Recorder plugin for WordPress up to version 2.2.3 allows unauthenticated remote attackers to access sensitive system information. The vulnerability has a low exploitation probability (EPSS 0.06%) and no known public exploit code, but successful exploitation could leak embedded sensitive data.
Stored cross-site scripting in HT Mega – Absolute Addons for WPBakery Page Builder allows authenticated attackers with low privileges to inject arbitrary web scripts. When an administrator or other high-privilege user views the injected content, the script executes in their browser, leading to session theft, account takeover, or site defacement. The vulnerability affects all versions up to 1.0.8; no active exploitation or public exploit code is known, and the EPSS probability is low.
DOM-based cross-site scripting in the CyberChimps Responsive Blocks WordPress plugin allows authenticated attackers to inject arbitrary JavaScript. The vulnerability affects plugin versions up to 2.0.6 and can be exploited by low-privileged users who create malicious block content, leading to script execution in the browsers of victims who view the affected page. No active exploitation or public exploit code has been identified at this time.
Data manipulation in QuantumCloud ChatBot 6.7.3 and below allows authenticated low-privilege users to bypass missing authorization checks and modify plugin data. The vulnerability has a CVSS 3.1 base score of 4.3 (Medium) and an EPSS probability of 0.05%, indicating low exploitation likelihood. No active exploitation has been confirmed, and no public exploit code is available at time of analysis.
A DOM-based cross-site scripting (XSS) vulnerability in the HT Slider For Elementor WordPress plugin up to version 1.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
SQL injection in DirectIQ Email Marketing plugin ≤2.0 for WordPress allows unauthenticated remote attackers to extract sensitive data from the underlying database. The vulnerability carries a CVSS 9.3 critical rating due to its network attack vector, low complexity, and lack of required privileges or user interaction. No public exploit or active exploitation has been confirmed, and EPSS likelihood is very low (0.05%).
Privilege escalation vulnerability in the MDJM Mobile DJ Manager WordPress plugin (versions ≤ 1.7.6) allows authenticated users to gain unauthorized access via missing authorization checks. A low-privilege attacker can exploit this to achieve full site compromise, with high impact on confidentiality, integrity, and availability. No active exploitation or public exploit code has been reported.
Unauthorized access to restricted whistleblowing data in the Trusty Whistleblowing WordPress plugin (≤1.5.2) allows remote, unauthenticated attackers to retrieve confidential reports via a missing authorization check. The vulnerability has no reported active exploitation or public exploit, but carries a CVSS score of 8.2 due to high confidentiality impact and low attack complexity. EPSS data indicates a 0.06% probability of exploitation in the wild, suggesting low immediate risk.
Unauthenticated missing authorization in the Abandoned Contact Form 7 WordPress plugin allows remote attackers to modify plugin data and cause a denial of service. The flaw affects versions up to 2.0 and stems from incorrectly configured access control levels, enabling any unauthenticated user to perform actions that should be restricted. The exploitation probability is low (EPSS 0.08%), and no active exploitation has been confirmed.
A security vulnerability in ovatheme BRW allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local File Inclusion in the National Weather Service Alerts WordPress plugin through version 1.3.5 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing sensitive configuration data or enabling further attacks like remote code execution via log poisoning. No public exploit or active exploitation has been reported, and EPSS indicates a low probability of exploitation (0.16%).
Reflected Cross-Site Scripting in the xili-dictionary WordPress plugin through version 2.12.5.2 allows attackers to execute arbitrary scripts in a victim's browser. A remote attacker can craft a malicious link that, when clicked by a user visiting an affected site, can steal cookies, redirect browsers, or deface content. No active exploitation or public exploit is currently known, and EPSS indicates a low probability of widespread exploitation.
Reflected cross-site scripting in the Infility Global WordPress plugin (≤2.12.7) allows unauthenticated remote attackers to execute arbitrary script in a victim's browser via a crafted link. No public exploit or active exploitation has been identified; the EPSS score is 0.04%, indicating low exploitation probability despite a CVSS 3.1 score of 7.1.
Reflected Cross-Site Scripting in the CSS3 Vertical Web Pricing Tables WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Version 1.9 and earlier are affected, and exploitation requires a victim to click a crafted link. No active exploitation or public exploit code has been reported, and the EPSS score of 0.04% indicates a very low probability of real-world attacks.
Privilege escalation in the CouponXxL Custom Post Types WordPress plugin (version ≤3.0) allows unauthenticated attackers to gain higher-level permissions due to incorrect privilege assignment. No active exploitation or public exploit code is known; EPSS predicts a 0.08 % probability of exploitation activity.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated remote attackers can inject arbitrary web scripts via a crafted URL due to improper input sanitization in the Flexo Counter WordPress plugin through version 1.0001. When a victim clicks the link, malicious JavaScript executes in their browser, potentially leading to session theft or defacement. No active exploitation or public exploit is confirmed, and EPSS indicates very low exploitation probability (0.04%, 13th percentile).
Local File Inclusion in Zikzag Core WordPress plugin through version 1.4.5 allows unauthenticated attackers to include arbitrary local files, potentially leading to information disclosure or remote code execution. The vulnerability carries a CVSS score of 8.1 with high attack complexity, and no known public exploit or active exploitation has been identified at this time.
Unauthenticated arbitrary file upload in HaruTheme's "Drag and Drop Multiple File Upload (Pro) - WooCommerce" WordPress plugin (all versions up to and including 5.0.6) lets remote attackers upload executable PHP files (a web shell) directly to the web server, yielding full remote code execution. The flaw carries a maximum CVSS 3.1 base score of 10.0 (scope-changed, network, no privileges, no user interaction), reported by Patchstack. EPSS is low at 0.19% and there is no public exploit identified at time of analysis, but the trivial exploitability and RCE outcome make this a high-priority patch.
Arbitrary file deletion in the FW Food Menu WordPress plugin (≤6.0.0) allows remote attackers to delete server files, potentially causing service unavailability. Exploitation requires no authentication or user interaction, making it highly accessible. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.08%).
Reflected cross-site scripting in the Bulk YouTube Post Creator WordPress plugin up to version 1.0 allows unauthenticated attackers to inject malicious scripts by tricking an authenticated user into clicking a crafted link. An attacker could hijack the victim's session, steal sensitive data, or perform actions on the victim's behalf within the context of the affected site. EPSS indicates very low exploitation probability (0.04%), and no active exploitation has been confirmed.
Local file inclusion in the FW Gallery WordPress plugin (versions up to 8.0.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data like configuration files. The high attack complexity suggests exploitation depends on specific server conditions, not default configurations. No public exploit or active exploitation has been confirmed at time of analysis.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Reflected cross-site scripting in the Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin up to version 0.5.8.4 allows unauthenticated attackers to inject arbitrary web scripts via crafted requests. Successful exploitation requires a victim to click a malicious link, leading to script execution in the victim's browser, which may steal session cookies or deface pages. No evidence of active exploitation or public exploit code exists at this time.
Reflected cross-site scripting (XSS) in the WordPress plugin FormLift for Infusionsoft Web Forms (versions up to 7.5.20) allows remote unauthenticated attackers to inject arbitrary web scripts via user-supplied input. Exploitation requires a victim to click a malicious link, but can lead to session theft, phishing, and other browser-based attacks. The vulnerability carries a CVSS score of 7.1, though EPSS indicates a very low (0.04%) probability of exploitation; no active exploitation or public exploit code has been identified.
Reflected Cross-Site Scripting (XSS) in the mojoomla School Management WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via unsanitized input, exploiting victims who click a crafted link. This vulnerability affects plugin versions through 92.0.0, with no known public exploit or active exploitation reported at the time of analysis.
Reflected cross-site scripting in the Smart Notification WordPress plugin up to version 10.3 enables unauthenticated attackers to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can lead to session hijacking, credential theft, or malicious actions on behalf of the victim. While no active exploitation or public exploit code is currently reported, the low CVSS impact and very low EPSS score suggest limited real-world risk at this time.
Local file inclusion in CTUsers WordPress plugin up to 1.0.0 allows unauthenticated attackers to include arbitrary local files via a crafted request. Exploitation requires user interaction and high attack complexity, but can lead to full compromise of the affected server, including disclosure of sensitive data or code execution. The vulnerability is not known to be actively exploited and has a low EPSS probability score.
Missing authorization checks in the WPKit For Elementor WordPress plugin (versions ≤ 1.1.0) allow unauthenticated attackers to escalate privileges via crafted requests that modify arbitrary WordPress options. The vulnerability requires user interaction and can lead to privilege escalation without user awareness. No active exploitation is confirmed, and EPSS indicates a very low exploitation probability (0.09%).
Local file inclusion in the SERPed.net WordPress plugin (versions ≤4.6) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. No patch is available, and the plugin may be closed or abandoned. Exploitation risk is tempered by high attack complexity and a low EPSS score (0.16%), though successful exploitation yields full confidentiality, integrity, and availability impact.
Remote, unauthenticated code injection in the Content No Cache WordPress plugin allows attackers to execute arbitrary PHP functions, leading to high confidentiality impact. This vulnerability, rated CVSS 8.6, affects all versions up to 0.1.3 and can be exploited without user interaction to disclose sensitive data such as configuration files. While exploitation is technically straightforward, EPSS data suggests a low probability of active exploitation in the wild.
Reflected cross-site scripting (XSS) in the WP Front User Submit / Front Editor WordPress plugin versions up to 4.9.3 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The attack requires user interaction (e.g., clicking a link) and can lead to script execution in the victim’s browser, potentially enabling data theft or defacement. No active exploitation or public exploit code has been reported, and EPSS indicates low probability of widespread exploitation.
Object injection via unsafe deserialization in the WP Optimize By xTraffic WordPress plugin allows unauthenticated remote attackers to achieve code execution by sending crafted serialized data. All plugin versions up to and including 5.1.6 are affected. No active exploitation or public exploit code has been identified, and EPSS predicts only a 0.13% chance of exploitation.
Reflected cross-site scripting in the Evangelische Termine WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a malicious link. Versions up to and including 3.3 are affected. Exploitation requires user interaction, and no active exploitation or public proof-of-concept has been identified at this time.
Reflected cross-site scripting in the Backwp WordPress plugin up to version 2.0.2 allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser when a malicious link is clicked. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and an EPSS score of 0.04%, indicating a low probability of widespread exploitation. No public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in the Photo Express for Google WordPress plugin up to version 0.3.2 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. Successful exploitation could lead to cookie theft, session hijacking, or defacement, but requires user interaction to click a crafted link. No active exploitation or public exploit code has been identified.
Stored cross-site scripting (XSS) in FasterThemes FastBook WordPress plugin through version 1.1 allows unauthenticated attackers to inject malicious scripts via web page input. When an administrator or other site user views the affected page, the script executes in their browser, potentially leading to session hijacking or credential theft. No active exploitation or public PoC is known, and EPSS estimates a very low exploitation probability (0.04%).
Account takeover via authentication bypass in WP SmartPay plugin versions up to 2.7.13 allows authenticated low-privileged users to gain full administrative control of the WordPress site. By exploiting an alternate authentication channel, attackers can escalate privileges, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is known; EPSS is low at 0.07%.
Authenticated path traversal in the WordPress Image Shadow plugin up to version 1.1.0 allows low-privileged users to delete arbitrary files on the server, leading to a high availability impact. The vulnerability requires an authenticated attacker with minimal privileges and can be exploited over the network with low complexity. No active exploitation or public exploit code is known at this time, reflected by a very low EPSS score of 0.08%.
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient input sanitization and output escaping. The unfiltered field names are stored alongside the sanitized values. Later, the admin-side AJAX endpoint ajax_get_table_data() returns those raw names as JSON column headers, and the client-side DataTables renderer injects them directly into the DOM without any HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in the Web Cam plugin for WordPress up to version 1.0 enables authenticated attackers (Contributor+) to inject arbitrary JavaScript via the slug parameter, affecting users who view injected pages. No active exploitation or public proof-of-concept has been identified, and EPSS indicates low exploitation probability (0.05%).
Stored cross-site scripting in the Namasha By Mdesign WordPress plugin allows authenticated attackers with Contributor-level access to inject JavaScript via the ‘playicon_title’ parameter. All plugin versions up to 1.2.00 are affected, enabling script execution when other users view the injected content. No active exploitation or public exploit code is known, and EPSS indicates a very low exploitation probability (0.04%).
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in the Event RSVP and Simple Event Management Plugin for WordPress up to 4.1.0 allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts via the 'emd_mb_meta' shortcode. Injected scripts execute whenever any user accesses a page containing the malicious shortcode, potentially leading to session hijacking or unauthorized actions. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.04%), indicating limited immediate risk.
The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Privilege escalation in the Simple User Registration plugin for WordPress up to version 6.3 allows unauthenticated attackers to register as administrators by sending crafted user meta values. A publicly available exploit exists, and the EPSS score of 29.28% indicates a high likelihood of exploitation, though it has not yet been added to CISA's Known Exploited Vulnerabilities catalog. Successful exploitation grants full control over the affected WordPress site.
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
The Everest Forms (Pro) WordPress plugin versions up to 1.9.4 contain an arbitrary file deletion vulnerability in the delete_entry_files() function due to insufficient path validation (CWE-36). Unauthenticated attackers can delete arbitrary files on the server by tricking an administrator into deleting a form entry, potentially leading to remote code execution through deletion of critical files like wp-config.php. This is a high-severity vulnerability (CVSS 7.5) that requires social engineering or admin interaction but can completely compromise WordPress installations.
The 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.
The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A privilege escalation vulnerability in Rameez Iqbal Real Estate Manager allows Privilege Escalation (CVSS 8.8). High severity vulnerability requiring prompt remediation.
CVE-2025-52822 is an SQL injection vulnerability in Iqonic Design's WP Roadmap WordPress plugin (versions up to 2.1.3) that allows authenticated attackers to execute arbitrary SQL commands. An attacker with user-level privileges can exploit this via network access without user interaction to read sensitive database contents and cause denial of service. The vulnerability has not been confirmed as actively exploited in the wild, but the high CVSS score (8.5) and low attack complexity indicate this should be treated as a priority for affected WordPress installations.
CVE-2025-52821 is a SQL Injection vulnerability in thanhtungtnt Video List Manager versions up to 1.7 that allows authenticated attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 8.5 with high confidentiality impact and cross-site scope implications, meaning successful exploitation could lead to unauthorized data access and potential lateral movement within affected systems. While the attack requires valid credentials (PR:L), the network accessibility and low attack complexity make this a significant risk for organizations using this plugin.
CVE-2025-52802 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
CVE-2025-52795 is a Cross-Site Request Forgery (CSRF) vulnerability in the aharonyan WP Front User Submit / Front Editor WordPress plugin (versions up to 4.9.4) that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a CVSS score of 7.1 with high availability impact, enabling attackers to modify or delete user-submitted content through malicious web requests without user consent.
CVE-2025-52794 is a Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form (versions up to 1.0.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads through contact form submissions, affecting any user who views the contaminated form data. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low attack complexity, making it readily exploitable in typical web deployments.
CVE-2025-52793 is a Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Settings that enables reflected Cross-Site Scripting (XSS) attacks. The vulnerability affects Esselink.nu Settings versions up to and including 2.94, allowing unauthenticated remote attackers to perform actions on behalf of users and inject malicious scripts with minimal user interaction. With a CVSS score of 7.1 and network-based attack vector, this vulnerability poses a moderate-to-significant risk to affected installations, particularly if actively exploited or if public proof-of-concept code becomes available.
CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the vgstef WP User Stylesheet Switcher WordPress plugin (versions up to v2.2.0) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a simple network request with user interaction to inject malicious scripts that execute in victims' browsers, potentially compromising user sessions and data. The vulnerability has not been confirmed as actively exploited in the wild, though the high CVSS score (7.1) and network-accessible attack vector indicate practical exploitability.
CVE-2025-52791 is a CSRF vulnerability in devfelixmoira Knowledge Base Maker (versions up to 1.1.8) that enables Stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can affect multiple users through stored payloads, with a CVSS score of 7.1 indicating medium-high severity. No KEV listing or confirmed EPSS data is available in public sources, and patch availability status requires verification with the vendor.
CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.
A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.
CVE-2025-52782 is a Reflected Cross-Site Scripting (XSS) vulnerability in King Rayhan Scroll UP WordPress plugin versions through 2.0 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction; attackers can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. KEV status and active exploitation data were not provided in available intelligence sources, though the reflected XSS nature suggests moderate real-world exploitability.
CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.