Wordpress Plugin
Monthly
CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
DOM-based Cross-Site Scripting (XSS) in ANON::form embedded secure form plugin for WordPress versions up to 1.7 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Information disclosure in ProfileGrid WordPress plugin versions up to 5.9.5.2 allows authenticated attackers with low privileges to retrieve sensitive system information, such as full server paths. This exposure can aid in further attacks by revealing the underlying directory structure. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
CVE-2025-52715 is a PHP Local File Inclusion (LFI) vulnerability in RadiusTheme's Classified Listing plugin that allows authenticated attackers to include and execute arbitrary local files through improper filename validation in PHP include/require statements. The vulnerability affects Classified Listing versions up to 4.2.0, and while the CVSS score of 7.5 indicates high severity, exploitation requires local authentication and non-standard attack complexity, suggesting moderate real-world risk absent evidence of active exploitation or public proof-of-concept.
Server-Side Request Forgery (SSRF) in BoldGrid Post and Page Builder plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to information disclosure or limited internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.
CVE-2025-52708 is a PHP Local File Inclusion (LFI) vulnerability in RealMag777 HUSKY versions up to 1.3.7, stemming from improper control of filenames in include/require statements. An authenticated attacker with low-to-medium privilege requirements can exploit this remotely to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS 7.5 score and requirement for authenticated access (PR:L) suggest moderate real-world risk; active exploitation status and POC availability are not confirmed from available data, but the vulnerability class (CWE-98 RFI/LFI) is historically high-value for attackers.
Stored cross-site scripting in Firelight Lightbox WordPress plugin up to version 2.3.16 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting (XSS) in WP-Members plugin for WordPress up to version 3.5.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Modern Footnotes WordPress plugin through 1.4.19 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into footnote content. When an administrator views a page containing the malicious footnote, the script executes in their browser, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the WordPress plugin Automatically Hierarchic Categories in Menu up to version 2.0.9 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. When an administrator views the affected menu page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Sitekit WordPress plugin through version 1.9 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in WPComplete 2.9.5 and earlier allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or data theft. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in Real Estate Manager WordPress plugin up to version 7.3 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, without their consent. The vulnerability has a CVSS score of 6.5 (Medium) with low EPSS probability (0.02%), and no public exploit or active exploitation has been identified.
Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in the WordPress plugin Mailing Group Listserv up to version 3.0.5 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying mailing list settings or deleting subscribers, by luring them to a malicious page. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector and low complexity, but requires user interaction. No public exploit or active exploitation has been identified, and the EPSS score is very low (0.02%).
Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in Mahmudul (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.
Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.
Missing authorization in Kata Plus WordPress plugin up to version 1.5.3 allows low-privileged attackers to exploit incorrectly configured access controls, leading to limited integrity and availability impact. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
Missing authorization in RafflePress Giveaways and Contests plugin for WordPress allows unauthenticated attackers to access functionality that should be restricted to authorized users. This affects versions through 1.12.17 and can lead to unauthorized modification of giveaway settings or data. No public exploit or active exploitation has been identified.
A security vulnerability in osama (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
CVE-2025-49995 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Cookie-Script.com WordPress plugin up to version 1.2.1 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying plugin settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in tggfref WP-Recall (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in contentstudio ContentStudio (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in App Builder WordPress plugin up to version 5.5.3 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially accessing sensitive information. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Contact Form 7 AWeber Extension up to version 0.1.38 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially causing limited availability impact. No public exploit or active exploitation has been identified, and the EPSS score is low (0.08%).
Missing authorization in WPFactory CRM ERP Business Solution for WordPress allows unauthenticated attackers to modify data without authentication. The vulnerability affects versions up to and including 1.13, with a CVSS score of 5.3 and low EPSS probability (0.06%). No public exploit or active exploitation has been identified.
A security vulnerability in Missing Authorization vulnerability in thanhtungtnt Video List Manager (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Server-Side Request Forgery (SSRF) in the WordPress plugin Auto Upload Images versions up to 3.3.2 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in PowerPress Podcasting plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure and potential internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in WPThumb plugin for WordPress up to version 0.10 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
A security vulnerability in Missing Authorization vulnerability in aguilatechnologies WP Customer Area (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in mahabub81 User Roles and Capabilities (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP User Profile Avatar plugin for WordPress allows authenticated low-privilege users to access or modify profile avatar data without proper permission checks. Affects versions up to 1.0.6. No public exploit or active exploitation identified.
A security vulnerability in Missing Authorization vulnerability in slui Media Hygiene (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49978 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Missing authorization in WANotifier WordPress plugin up to version 2.7.7 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes WordPress plugins allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying image size settings. The vulnerability affects all versions up to 1.0.9 and has a low EPSS score (0.05%), with no public exploit or active exploitation confirmed.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
CVE-2025-49971 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Zara 4 Image Compression WordPress plugin up to version 1.2.17.2 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially causing limited denial of service. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine WordPress plugin (versions 2.8.0-2.8.3) contains a missing capability check in the 'Meow_MWAI_Labs_MCP::can_access_mcp' function, allowing authenticated subscribers and above to access the Model Context Protocol (MCP) interface and execute arbitrary WordPress administrative commands. This enables privilege escalation, unauthorized user creation/modification, and data destruction through post and comment manipulation. The vulnerability has a CVSS score of 8.8 (High) and poses immediate risk to any WordPress installation running affected versions with user registration enabled.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A remote code execution vulnerability in all (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Missing authorization in the Breeze WordPress plugin up to version 2.2.13 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.
DOM-based Cross-Site Scripting (XSS) in CubeWP Framework versions up to 1.1.23 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in Responsive Blocks WordPress plugin up to version 2.0.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Missing authorization in CubeWP Forms for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized data modification. The vulnerability affects versions up to 1.1.5 and has a low EPSS score with no public exploit identified.
DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.
Server-Side Request Forgery (SSRF) in ProfileGrid WordPress plugin up to version 5.9.5.2 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure and potential internal network reconnaissance. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in If-So Dynamic Content Personalization plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
A security vulnerability in Missing Authorization vulnerability in tychesoftwares Arconix FAQ (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in myCred plugin for WordPress up to 2.9.4.2 allows unauthenticated attackers to perform unauthorized actions, potentially modifying user point balances. No active exploitation or public exploit code has been reported, and EPSS indicates a very low probability of exploitation (0.06%). Sites running myCred are exposed over the network with no authentication required.
Stored cross-site scripting in the Noptin WordPress plugin (newsletter-optin-box) up to version 3.8.7 allows authenticated, high-privileged attackers to inject malicious scripts that execute in the browsers of victim users. Exploitation requires administrator-level access and user interaction, limiting widespread automated attacks. No active exploitation or public proof-of-concept has been identified, and EPSS predicts a very low chance of real-world exploitation.
Open redirect vulnerability in FunnelKit Automation By Autonami WordPress plugin allows phishing attacks. An unauthenticated attacker can redirect users to malicious external sites via crafted URLs. No public exploit or active exploitation identified, and EPSS score is low (0.04%).
CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
DOM-based Cross-Site Scripting (XSS) in ANON::form embedded secure form plugin for WordPress versions up to 1.7 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Information disclosure in ProfileGrid WordPress plugin versions up to 5.9.5.2 allows authenticated attackers with low privileges to retrieve sensitive system information, such as full server paths. This exposure can aid in further attacks by revealing the underlying directory structure. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
CVE-2025-52715 is a PHP Local File Inclusion (LFI) vulnerability in RadiusTheme's Classified Listing plugin that allows authenticated attackers to include and execute arbitrary local files through improper filename validation in PHP include/require statements. The vulnerability affects Classified Listing versions up to 4.2.0, and while the CVSS score of 7.5 indicates high severity, exploitation requires local authentication and non-standard attack complexity, suggesting moderate real-world risk absent evidence of active exploitation or public proof-of-concept.
Server-Side Request Forgery (SSRF) in BoldGrid Post and Page Builder plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to information disclosure or limited internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.
CVE-2025-52708 is a PHP Local File Inclusion (LFI) vulnerability in RealMag777 HUSKY versions up to 1.3.7, stemming from improper control of filenames in include/require statements. An authenticated attacker with low-to-medium privilege requirements can exploit this remotely to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS 7.5 score and requirement for authenticated access (PR:L) suggest moderate real-world risk; active exploitation status and POC availability are not confirmed from available data, but the vulnerability class (CWE-98 RFI/LFI) is historically high-value for attackers.
Stored cross-site scripting in Firelight Lightbox WordPress plugin up to version 2.3.16 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting (XSS) in WP-Members plugin for WordPress up to version 3.5.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Modern Footnotes WordPress plugin through 1.4.19 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into footnote content. When an administrator views a page containing the malicious footnote, the script executes in their browser, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the WordPress plugin Automatically Hierarchic Categories in Menu up to version 2.0.9 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. When an administrator views the affected menu page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Sitekit WordPress plugin through version 1.9 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in WPComplete 2.9.5 and earlier allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or data theft. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in Real Estate Manager WordPress plugin up to version 7.3 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, without their consent. The vulnerability has a CVSS score of 6.5 (Medium) with low EPSS probability (0.02%), and no public exploit or active exploitation has been identified.
Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in the WordPress plugin Mailing Group Listserv up to version 3.0.5 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying mailing list settings or deleting subscribers, by luring them to a malicious page. The vulnerability has a CVSS score of 6.5 (Medium) with a network attack vector and low complexity, but requires user interaction. No public exploit or active exploitation has been identified, and the EPSS score is very low (0.02%).
Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in Mahmudul (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.
Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.
Missing authorization in Kata Plus WordPress plugin up to version 1.5.3 allows low-privileged attackers to exploit incorrectly configured access controls, leading to limited integrity and availability impact. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
Missing authorization in RafflePress Giveaways and Contests plugin for WordPress allows unauthenticated attackers to access functionality that should be restricted to authorized users. This affects versions through 1.12.17 and can lead to unauthorized modification of giveaway settings or data. No public exploit or active exploitation has been identified.
A security vulnerability in osama (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
CVE-2025-49995 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Cookie-Script.com WordPress plugin up to version 1.2.1 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying plugin settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in tggfref WP-Recall (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in contentstudio ContentStudio (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in App Builder WordPress plugin up to version 5.5.3 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially accessing sensitive information. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Contact Form 7 AWeber Extension up to version 0.1.38 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially causing limited availability impact. No public exploit or active exploitation has been identified, and the EPSS score is low (0.08%).
Missing authorization in WPFactory CRM ERP Business Solution for WordPress allows unauthenticated attackers to modify data without authentication. The vulnerability affects versions up to and including 1.13, with a CVSS score of 5.3 and low EPSS probability (0.06%). No public exploit or active exploitation has been identified.
A security vulnerability in Missing Authorization vulnerability in thanhtungtnt Video List Manager (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Server-Side Request Forgery (SSRF) in the WordPress plugin Auto Upload Images versions up to 3.3.2 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in PowerPress Podcasting plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure and potential internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in WPThumb plugin for WordPress up to version 0.10 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
A security vulnerability in Missing Authorization vulnerability in aguilatechnologies WP Customer Area (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in mahabub81 User Roles and Capabilities (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP User Profile Avatar plugin for WordPress allows authenticated low-privilege users to access or modify profile avatar data without proper permission checks. Affects versions up to 1.0.6. No public exploit or active exploitation identified.
A security vulnerability in Missing Authorization vulnerability in slui Media Hygiene (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49978 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Missing authorization in WANotifier WordPress plugin up to version 2.7.7 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes WordPress plugins allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying image size settings. The vulnerability affects all versions up to 1.0.9 and has a low EPSS score (0.05%), with no public exploit or active exploitation confirmed.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
CVE-2025-49971 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Zara 4 Image Compression WordPress plugin up to version 1.2.17.2 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially causing limited denial of service. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine WordPress plugin (versions 2.8.0-2.8.3) contains a missing capability check in the 'Meow_MWAI_Labs_MCP::can_access_mcp' function, allowing authenticated subscribers and above to access the Model Context Protocol (MCP) interface and execute arbitrary WordPress administrative commands. This enables privilege escalation, unauthorized user creation/modification, and data destruction through post and comment manipulation. The vulnerability has a CVSS score of 8.8 (High) and poses immediate risk to any WordPress installation running affected versions with user registration enabled.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A remote code execution vulnerability in all (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
Missing authorization in the Breeze WordPress plugin up to version 2.2.13 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.
DOM-based Cross-Site Scripting (XSS) in CubeWP Framework versions up to 1.1.23 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in Responsive Blocks WordPress plugin up to version 2.0.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Missing authorization in CubeWP Forms for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized data modification. The vulnerability affects versions up to 1.1.5 and has a low EPSS score with no public exploit identified.
DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.
Server-Side Request Forgery (SSRF) in ProfileGrid WordPress plugin up to version 5.9.5.2 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure and potential internal network reconnaissance. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in If-So Dynamic Content Personalization plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
A security vulnerability in Missing Authorization vulnerability in tychesoftwares Arconix FAQ (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in myCred plugin for WordPress up to 2.9.4.2 allows unauthenticated attackers to perform unauthorized actions, potentially modifying user point balances. No active exploitation or public exploit code has been reported, and EPSS indicates a very low probability of exploitation (0.06%). Sites running myCred are exposed over the network with no authentication required.
Stored cross-site scripting in the Noptin WordPress plugin (newsletter-optin-box) up to version 3.8.7 allows authenticated, high-privileged attackers to inject malicious scripts that execute in the browsers of victim users. Exploitation requires administrator-level access and user interaction, limiting widespread automated attacks. No active exploitation or public proof-of-concept has been identified, and EPSS predicts a very low chance of real-world exploitation.
Open redirect vulnerability in FunnelKit Automation By Autonami WordPress plugin allows phishing attacks. An unauthenticated attacker can redirect users to malicious external sites via crafted URLs. No public exploit or active exploitation identified, and EPSS score is low (0.04%).