Wordpress Plugin
Monthly
CVE-2025-31022 is an authentication bypass vulnerability in PayU India's payment processing platform (versions before 3.8.8) that allows attackers to bypass authentication mechanisms via an alternate path or channel, granting unauthorized access to sensitive payment and customer data. With a critical CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe threat to all PayU India users and their customers' payment information. Active exploitation status and public disclosure details should be verified through CISA KEV database and PayU's official security advisories.
CVE-2025-31019 is an authentication bypass vulnerability in miniOrange Password Policy Manager that allows authenticated attackers to escalate privileges and abuse authentication mechanisms through alternate pathways. Affected versions are 2.0.4 and earlier; attackers with low privileges (PR:L) can exploit this remotely without user interaction (UI:N) to achieve complete system compromise including confidentiality, integrity, and availability impacts. No public KEV or active exploitation data is available at this time, but the high CVSS score of 8.8 and authentication bypass nature indicate significant risk to WordPress sites using this plugin.
CVE-2025-23974 is an Incorrect Privilege Assignment vulnerability in ifkooo One-Login that enables unauthenticated remote privilege escalation. Versions 1.4 and earlier are affected, allowing attackers to gain high-impact unauthorized access to sensitive functions without user interaction. The CVSS 8.1 score reflects significant risk, though the high attack complexity (AC:H) suggests exploitation requires specific conditions; KEV/POC status and active exploitation data are not available in provided intelligence.
The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Social Sharing Plugin - Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.
The Essential Addons for Elementor - Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Essential Addons for Elementor - Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Missing authorization vulnerability in Christiaan Pieterse MaxiBlocks WordPress plugin (versions up to 2.1.0) that allows authenticated users with low privileges to escalate their access and perform unauthorized actions with high impact. An attacker with basic user credentials can bypass authorization checks to modify content, user accounts, or plugin settings, potentially leading to complete site compromise. The high CVSS score of 8.8 reflects the severe impact, though exploitation requires prior authentication access.
CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage plugin (versions through 1.1) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a malicious web request to inject persistent JavaScript into the application, affecting all users who view the compromised profile. The vulnerability requires user interaction (CVSS UI:R) but has cross-site scope impact (S:C), resulting in a 7.1 medium-high severity rating; KEV status and active exploitation data are not currently available in public disclosures.
Stored cross-site scripting in SEPA Girocode WordPress plugin through 0.5.1 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages. The vulnerability is triggered when a user with contributor-level access or higher submits a crafted input that is stored and later executed in the context of another user's browser session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in the Interactive Regional Map of Africa WordPress plugin allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery (CSRF) in the WordPress plugin Admin Notes up to version 1.1 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. The vulnerability requires user interaction (clicking a crafted link) and has low exploitation probability (EPSS 0.03%). No public exploit or active exploitation has been identified.
Unauthorized settings modification in WP Map Plugins Interactive UK Regional Map through version 2.0 enables attackers to change plugin configurations by tricking administrators into submitting a crafted request. This Cross-Site Request Forgery (CSRF) vulnerability has low exploitation likelihood (EPSS 0.03%) and no active exploitation or public exploit reported.
Stored cross-site scripting in Bacon Ipsum WordPress plugin through version 2.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Simple Nested Menu WordPress plugin version 1.0 and earlier allows authenticated users with low privileges to inject scripts into menu items, which execute in the browser of victims viewing the affected content. No active exploitation, public exploit, or patch has been reported at this time, and EPSS predicts very low exploitation probability.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery in WP Security Master plugin for WordPress allows unauthenticated attackers to perform unintended actions on behalf of authenticated users. Affects all versions up to 1.0.2. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability.
Cross-Site Request Forgery (CSRF) in Atelier Create CV WordPress plugin up to version 1.1.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings. The vulnerability requires user interaction (clicking a crafted link) and has low impact (integrity only). No public exploit or active exploitation has been identified.
Cross-site request forgery in the Wp Easy Allopass WordPress plugin (versions through 4.1.1) enables an unauthenticated remote attacker to forge state-changing requests on behalf of a logged-in WordPress administrator. The plugin, which integrates the Allopass micropayment gateway, lacks proper nonce validation on at least one administrative action handler, so a victim admin browsing a malicious page unknowingly triggers unauthorized plugin operations. No public exploit code has been identified and EPSS of 0.03% (7th percentile) signals negligible real-world exploitation probability at time of analysis.
Stored cross-site scripting in Video Embeds WordPress plugin up to version 0.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into video embed pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the Abbie Expander WordPress plugin (≤1.0.1) enables authenticated attackers to inject JavaScript payloads into pages. When other users view the affected pages, the injected scripts execute, leading to data theft or unauthorized actions. The vulnerability has a low EPSS exploitation probability and is not known to be actively exploited.
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft's Konami Easter Egg browser extension (versions through v0.4) that can lead to Stored Cross-Site Scripting (XSS) attacks. An attacker can craft a malicious request to inject persistent JavaScript code that executes in the context of affected users' browsers, potentially compromising user sessions, stealing credentials, or performing unauthorized actions. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to users of the extension, though real-world exploitation likelihood depends on whether public exploits exist and the extension's actual user base.
SQL injection vulnerability in Andrei Filonov's WP Text Expander WordPress plugin (versions through 1.0.1) that allows authenticated attackers with high-privilege administrative roles to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.6 (high severity) due to its ability to achieve confidentiality compromise and limited availability impact, though it requires administrative credentials to exploit. No current KEV (Known Exploited Vulnerability) status or public proof-of-concept is indicated in the provided data, suggesting limited real-world active exploitation at present.
Stored cross-site scripting in the Simple Membership WordPress plugin ≤4.6.3 allows authenticated administrators to inject malicious scripts that execute when another user views a crafted page. The attack requires high privileges and user interaction; no active exploitation or public exploit code is known. Impact is limited to low confidentiality and integrity compromise on the victim's browser session.
Cross-Site Request Forgery (CSRF) in WP Time Slots Booking Form plugin for WordPress allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated administrators. Affected versions up to 1.2.30 can be exploited by tricking an admin into clicking a malicious link, enabling limited integrity impact such as altering booking form settings. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.
SQL injection vulnerability in Ruben Garcia ShortLinks Pro versions up to 1.0.7 that allows authenticated attackers with high privileges to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.6 (High) and affects the ShortLinks Pro WordPress plugin; while the attack requires elevated privileges, successful exploitation could lead to unauthorized data access and limited system availability impacts. No active exploitation in the wild or public POC has been widely reported at this time, though the SQL injection class (CWE-89) remains a critical attack vector.
SQL Injection vulnerability in GamiPress (a WordPress gamification plugin) affecting versions through 7.4.5. An authenticated attacker with high privileges can execute arbitrary SQL commands to read sensitive database information, potentially compromising data confidentiality and availability. While the CVSS score is 7.6 (high), the attack requires high privileges and there is no public indication of active exploitation in the wild.
Open redirect vulnerability in Newspack Newsletters plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirection functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
SQL injection vulnerability in Themefic Hydra Booking plugin versions through 1.1.10 that allows authenticated attackers to execute arbitrary SQL queries. An attacker with user-level privileges can manipulate SQL commands to extract sensitive database information, bypass authentication, or modify data without user interaction. This vulnerability has a CVSS score of 8.5 (High) and represents a significant risk to WordPress installations using affected versions of the plugin.
Stored cross-site scripting (XSS) vulnerability in SeedProd's 404 Page plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Affected versions prior to 1.0.2 are vulnerable; a patch is available. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in WPtouch 4.3.60 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in WP Page Loading plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. Affects versions through 1.0.6. No public exploit or active exploitation identified; EPSS score is low (0.03%).
Stored cross-site scripting in BRW WordPress plugin up to version 1.8.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
PHP Local File Inclusion (LFI) vulnerability in ovatheme BRW versions up to 1.8.6, stemming from improper control of filename parameters in include/require statements. An authenticated attacker with low privileges can exploit this to read arbitrary files from the server filesystem, potentially gaining access to sensitive configuration files, source code, or credentials. The vulnerability requires network access and authenticated user status (CWE-98 improper input validation on file paths), with a CVSS score of 7.5 indicating high confidentiality and integrity impact.
Stored cross-site scripting in The Events Calendar Countdown Addon for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into event countdown displays. Affects versions up to 1.4.9. No public exploit or active exploitation identified.
Stored cross-site scripting in the Frontend Dashboard WordPress plugin (≤2.2.8) allows authenticated attackers with low privileges to inject malicious scripts into dashboard fields, which execute in the browsers of other users—including administrators—who view the affected content. Exploitation requires an attacker to have at least a Subscriber-level account and user interaction from a victim; no active exploitation or public exploit code is known.
Stored cross-site scripting in HT Team Member WordPress plugin up to version 1.1.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
PHP Local File Inclusion (LFI) vulnerability in WP Travel Engine affecting versions through 6.5.1. An authenticated attacker with low privileges can exploit improper filename control in PHP include/require statements to read arbitrary files from the server, potentially obtaining sensitive configuration data, credentials, or source code. While the CVSS score is moderate (7.5), the vulnerability requires authentication and higher attack complexity, but successful exploitation could lead to complete information disclosure and potential privilege escalation.
PHP Local File Inclusion (LFI) vulnerability in Magazine3's WP Multilang plugin versions up to 2.4.19, stemming from improper control of filenames in PHP include/require statements. An authenticated attacker with low privileges can exploit this vulnerability to read arbitrary local files on the affected WordPress server, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 7.5 reflects high confidentiality and integrity impact, though exploitation requires valid credentials and non-standard conditions (AC:H).
Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Search with Typesense WordPress plugin up to version 2.0.10 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-based cross-site scripting in the Greenshift WordPress plugin allows authenticated attackers with low privileges to execute arbitrary JavaScript in victims' browsers. The vulnerability affects all versions up to and including 11.5.5. No public exploit or active exploitation has been identified at this time, and the EPSS score of 0.05% indicates a low probability of widespread exploitation.
Stored cross-site scripting in WebHotelier WordPress plugin up to version 1.9.2 allows authenticated attackers with contributor-level access to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Event post WordPress plugin through version 5.10.1 allows authenticated attackers to inject arbitrary web scripts via unsanitized post fields, which execute when an administrator views the crafted content. This vulnerability carries a medium CVSS base score of 6.5, with low EPSS exploitation probability and no evidence of active exploitation. User interaction and authentication are required, limiting widespread impact.
Sensitive information exposure in the Crawlomatic Multisite Scraper Post Generator WordPress plugin through version 2.6.8.2 allows unauthenticated remote attackers to retrieve embedded sensitive data via transmitted responses, due to insertion of sensitive information into sent data. No authentication or user interaction is required, but only low-impact confidentiality is compromised. No active exploitation or public exploit is known at time of analysis (EPSS 0.07%).
Missing authorization in Crawlomatic Multisite Scraper Post Generator allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 2.6.8.2. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Cozmoslabs Profile Builder allows Phishing (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
Authenticated low-privileged users can exploit a missing authorization check in Ultimate WP Mail plugin for WordPress up to version 1.3.5 to bypass access controls, potentially leading to full site takeover.
Cross-site request forgery (CSRF) in WP Table Builder versions up to 2.0.6 allows remote unauthenticated attackers to perform unauthorized actions on behalf of an authenticated administrator via crafted requests. Successful exploitation requires the victim to click a malicious link while logged in to the WordPress admin panel, potentially leading to unintended modifications of table content. No public exploit code or active exploitation has been identified; EPSS forecasts very low exploitation likelihood.
Cross-Site Request Forgery in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. Affected versions up to 3.8.0. No public exploit or active exploitation identified; EPSS score is low (0.03%).
Cross-site request forgery in the WP Maintenance Mode & Site Under Construction plugin up to version 4.3 allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings, via crafted requests. The vulnerability affects WordPress sites running the plugin and requires a logged-in administrator to visit a malicious link, resulting in limited integrity impact with no confidentiality or availability compromise. There is no evidence of active exploitation, and the EPSS score indicates a very low exploitation probability.
Cross-site request forgery in the 'Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant' WordPress plugin (versions through 4.1.1) allows a remote unauthenticated attacker to perform unauthorized plugin configuration changes by tricking an authenticated WordPress administrator into clicking a crafted link or visiting a malicious page. The vulnerability stems from missing or insufficient CSRF token validation on plugin action handlers, enabling integrity-impacting changes - such as disabling spam protection or altering reCaptcha settings - without the administrator's knowledge. No public exploit has been identified at time of analysis, and EPSS at 0.03% (7th percentile) reflects very low observed exploitation interest.
Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Tools up to version 5.24 allows unauthenticated attackers to trick authenticated administrators into unintentionally performing actions such as modifying plugin settings. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.03%).
A security vulnerability in Missing Authorization vulnerability in sergiotrinity Trinity Audio (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Market Exporter WordPress plugin up to version 2.0.22 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an unauthenticated attacker to trick an authenticated administrator into performing unwanted actions, such as modifying plugin settings, resulting in low integrity impact. No active exploitation or public exploit code has been identified; the EPSS score of 0.03% indicates a very low probability of exploitation.
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
Blind SQL injection vulnerability in WC Vendors Marketplace plugin versions through 2.5.6 that allows authenticated attackers with high privileges (administrator or vendor) to extract sensitive database information without direct output visibility. The vulnerability has a CVSS score of 7.6 with high confidentiality impact, though integrity is not compromised and availability impact is low. No publicly available exploit code or active exploitation has been confirmed at this time, but the attack requires only network access and high privilege authentication.
Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin (versions up to 3.6.1) that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When victims view the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or defacement. While the CVSS score of 7.6 indicates moderate-to-high severity, the requirement for high-privilege authentication (PR:H) significantly limits exploitation scope compared to unauthenticated XSS vulnerabilities.
Authenticated code injection in Team Showcase WordPress plugin allows attackers with contributor-level access or higher to execute arbitrary shortcodes, leading to limited information disclosure. The vulnerability is patched in version 25.05.13, and no active exploitation has been reported.
A security vulnerability in Missing Authorization vulnerability in cmoreira Team Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Testimonials Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) vulnerability in the Shortcodes Ultimate WordPress plugin versions up to 7.3.5 allows authenticated attackers to inject arbitrary web scripts that execute when an administrator or other user views a page containing the malicious shortcode. This could lead to session hijacking, credential theft, or site defacement. No active exploitation has been reported, and the EPSS score is very low (0.05%), indicating limited real-world risk.
Stored cross-site scripting in ShiftNav - Responsive Mobile Menu plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability affects all versions up to and including 1.8, and no public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Bellows Accordion Menu WordPress plugin allows authenticated attackers with contributor-level or higher permissions to inject malicious scripts into accordion items. When other users view the affected pages, the scripts execute in their browsers, potentially leading to session hijacking, account takeover, or content manipulation. No active exploitation or public exploit has been identified; the EPSS score of 0.05% indicates low exploitation probability.
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in nK DocsPress (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery in the Everest Backup WordPress plugin up to version 2.3.3 allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Exploitation requires tricking an administrator into clicking a link, resulting in limited integrity impact without confidentiality or availability loss. No active exploitation or public exploit code has been identified, and EPSS predicts a very low probability of exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in POEditor that enables path traversal attacks, affecting versions 0.9.10 and earlier. An attacker can exploit this via a crafted request to perform unauthorized actions on behalf of an authenticated user, potentially leading to high availability impact. While the CVSS score of 7.4 indicates a significant threat, the requirement for user interaction (UI:R) and network-based attack vector limits real-world exploitability; current KEV and EPSS data are needed to determine if active exploitation is occurring.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in RTMKit Addons for Elementor through version 1.6.0 allows authenticated attackers with contributor-level privileges to inject arbitrary JavaScript into pages. When an administrator views the compromised page, the script executes with their session, enabling data theft or further actions. No active exploitation or public proof-of-concept has been identified; EPSS score is low at 0.05%.
Stored cross-site scripting in Image Hover Effects Block for WordPress up to version 1.4.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
PHP Local File Inclusion (LFI) vulnerability in the WP Shopify plugin (versions up to 1.5.3) that allows authenticated attackers to include and execute arbitrary local files on the web server through improper control of filename parameters in PHP include/require statements. The vulnerability requires low-privilege user access (PR:L) and has moderate attack complexity (AC:H), but results in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making it a significant risk for WordPress sites using this plugin.
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light plugin (versions up to 3.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to trick authenticated users into performing unintended actions, resulting in persistent XSS payload injection that affects all subsequent visitors. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world exploitability without requiring elevated privileges.
Cross-Site Request Forgery (CSRF) in CubeWP - All-in-One Dynamic Content Framework versions up to 1.1.23 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings. The vulnerability has a low EPSS score (0.03%) and no public exploit or active exploitation has been identified.
Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
A SQL Injection vulnerability (CWE-89) exists in Renzo Tejada's 'Libro de Reclamaciones y Quejas' application versions up to 0.9, allowing authenticated attackers with high privileges to execute arbitrary SQL commands. While the CVSS score is 7.6 (High), the attack requires prior authentication and high-level privileges (PR:H), significantly reducing real-world exploitability. The vulnerability impacts confidentiality (data exfiltration) and limited availability, though integrity is not affected. Without confirmed KEV status, active exploitation data, or public proof-of-concept, this represents a medium-priority issue requiring patching but not immediate emergency response.
Cross-Site Request Forgery (CSRF) in Elite Video Player for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying settings or deleting data. The vulnerability affects versions up to and including 10.0.5. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery in WP-Recall plugin for WordPress allows privilege escalation. An attacker can trick an authenticated admin into performing unintended actions, potentially gaining elevated access. No public exploit or active exploitation identified.
Cross-Site Request Forgery in Simple Keyword to Link plugin up to version 1.5 enables unauthenticated attackers to trick WordPress administrators into unknowingly modifying plugin settings by visiting a malicious page. The vulnerability carries a CVSS 4.3 medium severity, but EPSS indicates a 0.03% probability of exploitation, and no public exploit code or active exploitation is confirmed.
Authenticated low-privilege users can bypass access controls in Slack Notifications by dorzki 2.0.7 and earlier, potentially disrupting notification delivery. Exploitation requires an authenticated session with low privileges and has no direct confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Nexa Blocks WordPress plugin up to version 1.1.0 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited impact on internal systems. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
Cross-Site Request Forgery (CSRF) in Advanced Post List WordPress plugin up to version 0.5.6.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
CVE-2025-31022 is an authentication bypass vulnerability in PayU India's payment processing platform (versions before 3.8.8) that allows attackers to bypass authentication mechanisms via an alternate path or channel, granting unauthorized access to sensitive payment and customer data. With a critical CVSS score of 9.8 and network-based attack vector requiring no privileges or user interaction, this vulnerability poses an immediate and severe threat to all PayU India users and their customers' payment information. Active exploitation status and public disclosure details should be verified through CISA KEV database and PayU's official security advisories.
CVE-2025-31019 is an authentication bypass vulnerability in miniOrange Password Policy Manager that allows authenticated attackers to escalate privileges and abuse authentication mechanisms through alternate pathways. Affected versions are 2.0.4 and earlier; attackers with low privileges (PR:L) can exploit this remotely without user interaction (UI:N) to achieve complete system compromise including confidentiality, integrity, and availability impacts. No public KEV or active exploitation data is available at this time, but the high CVSS score of 8.8 and authentication bypass nature indicate significant risk to WordPress sites using this plugin.
CVE-2025-23974 is an Incorrect Privilege Assignment vulnerability in ifkooo One-Login that enables unauthenticated remote privilege escalation. Versions 1.4 and earlier are affected, allowing attackers to gain high-impact unauthorized access to sensitive functions without user interaction. The CVSS 8.1 score reflects significant risk, though the high attack complexity (AC:H) suggests exploitation requires specific conditions; KEV/POC status and active exploitation data are not available in provided intelligence.
The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Social Sharing Plugin - Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.
The Essential Addons for Elementor - Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Essential Addons for Elementor - Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Missing authorization vulnerability in Christiaan Pieterse MaxiBlocks WordPress plugin (versions up to 2.1.0) that allows authenticated users with low privileges to escalate their access and perform unauthorized actions with high impact. An attacker with basic user credentials can bypass authorization checks to modify content, user accounts, or plugin settings, potentially leading to complete site compromise. The high CVSS score of 8.8 reflects the severe impact, though exploitation requires prior authentication access.
CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage plugin (versions through 1.1) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a malicious web request to inject persistent JavaScript into the application, affecting all users who view the compromised profile. The vulnerability requires user interaction (CVSS UI:R) but has cross-site scope impact (S:C), resulting in a 7.1 medium-high severity rating; KEV status and active exploitation data are not currently available in public disclosures.
Stored cross-site scripting in SEPA Girocode WordPress plugin through 0.5.1 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages. The vulnerability is triggered when a user with contributor-level access or higher submits a crafted input that is stored and later executed in the context of another user's browser session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in the Interactive Regional Map of Africa WordPress plugin allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery (CSRF) in the WordPress plugin Admin Notes up to version 1.1 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. The vulnerability requires user interaction (clicking a crafted link) and has low exploitation probability (EPSS 0.03%). No public exploit or active exploitation has been identified.
Unauthorized settings modification in WP Map Plugins Interactive UK Regional Map through version 2.0 enables attackers to change plugin configurations by tricking administrators into submitting a crafted request. This Cross-Site Request Forgery (CSRF) vulnerability has low exploitation likelihood (EPSS 0.03%) and no active exploitation or public exploit reported.
Stored cross-site scripting in Bacon Ipsum WordPress plugin through version 2.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Simple Nested Menu WordPress plugin version 1.0 and earlier allows authenticated users with low privileges to inject scripts into menu items, which execute in the browser of victims viewing the affected content. No active exploitation, public exploit, or patch has been reported at this time, and EPSS predicts very low exploitation probability.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery in WP Security Master plugin for WordPress allows unauthenticated attackers to perform unintended actions on behalf of authenticated users. Affects all versions up to 1.0.2. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability.
Cross-Site Request Forgery (CSRF) in Atelier Create CV WordPress plugin up to version 1.1.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings. The vulnerability requires user interaction (clicking a crafted link) and has low impact (integrity only). No public exploit or active exploitation has been identified.
Cross-site request forgery in the Wp Easy Allopass WordPress plugin (versions through 4.1.1) enables an unauthenticated remote attacker to forge state-changing requests on behalf of a logged-in WordPress administrator. The plugin, which integrates the Allopass micropayment gateway, lacks proper nonce validation on at least one administrative action handler, so a victim admin browsing a malicious page unknowingly triggers unauthorized plugin operations. No public exploit code has been identified and EPSS of 0.03% (7th percentile) signals negligible real-world exploitation probability at time of analysis.
Stored cross-site scripting in Video Embeds WordPress plugin up to version 0.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into video embed pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the Abbie Expander WordPress plugin (≤1.0.1) enables authenticated attackers to inject JavaScript payloads into pages. When other users view the affected pages, the injected scripts execute, leading to data theft or unauthorized actions. The vulnerability has a low EPSS exploitation probability and is not known to be actively exploited.
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft's Konami Easter Egg browser extension (versions through v0.4) that can lead to Stored Cross-Site Scripting (XSS) attacks. An attacker can craft a malicious request to inject persistent JavaScript code that executes in the context of affected users' browsers, potentially compromising user sessions, stealing credentials, or performing unauthorized actions. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to users of the extension, though real-world exploitation likelihood depends on whether public exploits exist and the extension's actual user base.
SQL injection vulnerability in Andrei Filonov's WP Text Expander WordPress plugin (versions through 1.0.1) that allows authenticated attackers with high-privilege administrative roles to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.6 (high severity) due to its ability to achieve confidentiality compromise and limited availability impact, though it requires administrative credentials to exploit. No current KEV (Known Exploited Vulnerability) status or public proof-of-concept is indicated in the provided data, suggesting limited real-world active exploitation at present.
Stored cross-site scripting in the Simple Membership WordPress plugin ≤4.6.3 allows authenticated administrators to inject malicious scripts that execute when another user views a crafted page. The attack requires high privileges and user interaction; no active exploitation or public exploit code is known. Impact is limited to low confidentiality and integrity compromise on the victim's browser session.
Cross-Site Request Forgery (CSRF) in WP Time Slots Booking Form plugin for WordPress allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated administrators. Affected versions up to 1.2.30 can be exploited by tricking an admin into clicking a malicious link, enabling limited integrity impact such as altering booking form settings. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.
SQL injection vulnerability in Ruben Garcia ShortLinks Pro versions up to 1.0.7 that allows authenticated attackers with high privileges to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.6 (High) and affects the ShortLinks Pro WordPress plugin; while the attack requires elevated privileges, successful exploitation could lead to unauthorized data access and limited system availability impacts. No active exploitation in the wild or public POC has been widely reported at this time, though the SQL injection class (CWE-89) remains a critical attack vector.
SQL Injection vulnerability in GamiPress (a WordPress gamification plugin) affecting versions through 7.4.5. An authenticated attacker with high privileges can execute arbitrary SQL commands to read sensitive database information, potentially compromising data confidentiality and availability. While the CVSS score is 7.6 (high), the attack requires high privileges and there is no public indication of active exploitation in the wild.
Open redirect vulnerability in Newspack Newsletters plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirection functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
SQL injection vulnerability in Themefic Hydra Booking plugin versions through 1.1.10 that allows authenticated attackers to execute arbitrary SQL queries. An attacker with user-level privileges can manipulate SQL commands to extract sensitive database information, bypass authentication, or modify data without user interaction. This vulnerability has a CVSS score of 8.5 (High) and represents a significant risk to WordPress installations using affected versions of the plugin.
Stored cross-site scripting (XSS) vulnerability in SeedProd's 404 Page plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Affected versions prior to 1.0.2 are vulnerable; a patch is available. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in WPtouch 4.3.60 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Cross-Site Request Forgery (CSRF) in WP Page Loading plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. Affects versions through 1.0.6. No public exploit or active exploitation identified; EPSS score is low (0.03%).
Stored cross-site scripting in BRW WordPress plugin up to version 1.8.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
PHP Local File Inclusion (LFI) vulnerability in ovatheme BRW versions up to 1.8.6, stemming from improper control of filename parameters in include/require statements. An authenticated attacker with low privileges can exploit this to read arbitrary files from the server filesystem, potentially gaining access to sensitive configuration files, source code, or credentials. The vulnerability requires network access and authenticated user status (CWE-98 improper input validation on file paths), with a CVSS score of 7.5 indicating high confidentiality and integrity impact.
Stored cross-site scripting in The Events Calendar Countdown Addon for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into event countdown displays. Affects versions up to 1.4.9. No public exploit or active exploitation identified.
Stored cross-site scripting in the Frontend Dashboard WordPress plugin (≤2.2.8) allows authenticated attackers with low privileges to inject malicious scripts into dashboard fields, which execute in the browsers of other users—including administrators—who view the affected content. Exploitation requires an attacker to have at least a Subscriber-level account and user interaction from a victim; no active exploitation or public exploit code is known.
Stored cross-site scripting in HT Team Member WordPress plugin up to version 1.1.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
PHP Local File Inclusion (LFI) vulnerability in WP Travel Engine affecting versions through 6.5.1. An authenticated attacker with low privileges can exploit improper filename control in PHP include/require statements to read arbitrary files from the server, potentially obtaining sensitive configuration data, credentials, or source code. While the CVSS score is moderate (7.5), the vulnerability requires authentication and higher attack complexity, but successful exploitation could lead to complete information disclosure and potential privilege escalation.
PHP Local File Inclusion (LFI) vulnerability in Magazine3's WP Multilang plugin versions up to 2.4.19, stemming from improper control of filenames in PHP include/require statements. An authenticated attacker with low privileges can exploit this vulnerability to read arbitrary local files on the affected WordPress server, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 7.5 reflects high confidentiality and integrity impact, though exploitation requires valid credentials and non-standard conditions (AC:H).
Stored cross-site scripting (XSS) in WP Social Widget through version 2.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Product Catalog Simple WordPress plugin up to version 1.8.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into product catalog pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.05%).
Stored cross-site scripting in Search with Typesense WordPress plugin up to version 2.0.10 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
DOM-based cross-site scripting in the Greenshift WordPress plugin allows authenticated attackers with low privileges to execute arbitrary JavaScript in victims' browsers. The vulnerability affects all versions up to and including 11.5.5. No public exploit or active exploitation has been identified at this time, and the EPSS score of 0.05% indicates a low probability of widespread exploitation.
Stored cross-site scripting in WebHotelier WordPress plugin up to version 1.9.2 allows authenticated attackers with contributor-level access to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Event post WordPress plugin through version 5.10.1 allows authenticated attackers to inject arbitrary web scripts via unsanitized post fields, which execute when an administrator views the crafted content. This vulnerability carries a medium CVSS base score of 6.5, with low EPSS exploitation probability and no evidence of active exploitation. User interaction and authentication are required, limiting widespread impact.
Sensitive information exposure in the Crawlomatic Multisite Scraper Post Generator WordPress plugin through version 2.6.8.2 allows unauthenticated remote attackers to retrieve embedded sensitive data via transmitted responses, due to insertion of sensitive information into sent data. No authentication or user interaction is required, but only low-impact confidentiality is compromised. No active exploitation or public exploit is known at time of analysis (EPSS 0.07%).
Missing authorization in Crawlomatic Multisite Scraper Post Generator allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 2.6.8.2. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Cozmoslabs Profile Builder allows Phishing (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
Authenticated low-privileged users can exploit a missing authorization check in Ultimate WP Mail plugin for WordPress up to version 1.3.5 to bypass access controls, potentially leading to full site takeover.
Cross-site request forgery (CSRF) in WP Table Builder versions up to 2.0.6 allows remote unauthenticated attackers to perform unauthorized actions on behalf of an authenticated administrator via crafted requests. Successful exploitation requires the victim to click a malicious link while logged in to the WordPress admin panel, potentially leading to unintended modifications of table content. No public exploit code or active exploitation has been identified; EPSS forecasts very low exploitation likelihood.
Cross-Site Request Forgery in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. Affected versions up to 3.8.0. No public exploit or active exploitation identified; EPSS score is low (0.03%).
Cross-site request forgery in the WP Maintenance Mode & Site Under Construction plugin up to version 4.3 allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings, via crafted requests. The vulnerability affects WordPress sites running the plugin and requires a logged-in administrator to visit a malicious link, resulting in limited integrity impact with no confidentiality or availability compromise. There is no evidence of active exploitation, and the EPSS score indicates a very low exploitation probability.
Cross-site request forgery in the 'Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant' WordPress plugin (versions through 4.1.1) allows a remote unauthenticated attacker to perform unauthorized plugin configuration changes by tricking an authenticated WordPress administrator into clicking a crafted link or visiting a malicious page. The vulnerability stems from missing or insufficient CSRF token validation on plugin action handlers, enabling integrity-impacting changes - such as disabling spam protection or altering reCaptcha settings - without the administrator's knowledge. No public exploit has been identified at time of analysis, and EPSS at 0.03% (7th percentile) reflects very low observed exploitation interest.
Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Tools up to version 5.24 allows unauthenticated attackers to trick authenticated administrators into unintentionally performing actions such as modifying plugin settings. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.03%).
A security vulnerability in Missing Authorization vulnerability in sergiotrinity Trinity Audio (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Market Exporter WordPress plugin up to version 2.0.22 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an unauthenticated attacker to trick an authenticated administrator into performing unwanted actions, such as modifying plugin settings, resulting in low integrity impact. No active exploitation or public exploit code has been identified; the EPSS score of 0.03% indicates a very low probability of exploitation.
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
Blind SQL injection vulnerability in WC Vendors Marketplace plugin versions through 2.5.6 that allows authenticated attackers with high privileges (administrator or vendor) to extract sensitive database information without direct output visibility. The vulnerability has a CVSS score of 7.6 with high confidentiality impact, though integrity is not compromised and availability impact is low. No publicly available exploit code or active exploitation has been confirmed at this time, but the attack requires only network access and high privilege authentication.
Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin (versions up to 3.6.1) that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When victims view the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or defacement. While the CVSS score of 7.6 indicates moderate-to-high severity, the requirement for high-privilege authentication (PR:H) significantly limits exploitation scope compared to unauthenticated XSS vulnerabilities.
Authenticated code injection in Team Showcase WordPress plugin allows attackers with contributor-level access or higher to execute arbitrary shortcodes, leading to limited information disclosure. The vulnerability is patched in version 25.05.13, and no active exploitation has been reported.
A security vulnerability in Missing Authorization vulnerability in cmoreira Team Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Testimonials Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) vulnerability in the Shortcodes Ultimate WordPress plugin versions up to 7.3.5 allows authenticated attackers to inject arbitrary web scripts that execute when an administrator or other user views a page containing the malicious shortcode. This could lead to session hijacking, credential theft, or site defacement. No active exploitation has been reported, and the EPSS score is very low (0.05%), indicating limited real-world risk.
Stored cross-site scripting in ShiftNav - Responsive Mobile Menu plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability affects all versions up to and including 1.8, and no public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in the Bellows Accordion Menu WordPress plugin allows authenticated attackers with contributor-level or higher permissions to inject malicious scripts into accordion items. When other users view the affected pages, the scripts execute in their browsers, potentially leading to session hijacking, account takeover, or content manipulation. No active exploitation or public exploit has been identified; the EPSS score of 0.05% indicates low exploitation probability.
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in nK DocsPress (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery in the Everest Backup WordPress plugin up to version 2.3.3 allows remote attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. Exploitation requires tricking an administrator into clicking a link, resulting in limited integrity impact without confidentiality or availability loss. No active exploitation or public exploit code has been identified, and EPSS predicts a very low probability of exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in POEditor that enables path traversal attacks, affecting versions 0.9.10 and earlier. An attacker can exploit this via a crafted request to perform unauthorized actions on behalf of an authenticated user, potentially leading to high availability impact. While the CVSS score of 7.4 indicates a significant threat, the requirement for user interaction (UI:R) and network-based attack vector limits real-world exploitability; current KEV and EPSS data are needed to determine if active exploitation is occurring.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) in RTMKit Addons for Elementor through version 1.6.0 allows authenticated attackers with contributor-level privileges to inject arbitrary JavaScript into pages. When an administrator views the compromised page, the script executes with their session, enabling data theft or further actions. No active exploitation or public proof-of-concept has been identified; EPSS score is low at 0.05%.
Stored cross-site scripting in Image Hover Effects Block for WordPress up to version 1.4.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
PHP Local File Inclusion (LFI) vulnerability in the WP Shopify plugin (versions up to 1.5.3) that allows authenticated attackers to include and execute arbitrary local files on the web server through improper control of filename parameters in PHP include/require statements. The vulnerability requires low-privilege user access (PR:L) and has moderate attack complexity (AC:H), but results in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making it a significant risk for WordPress sites using this plugin.
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light plugin (versions up to 3.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to trick authenticated users into performing unintended actions, resulting in persistent XSS payload injection that affects all subsequent visitors. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world exploitability without requiring elevated privileges.
Cross-Site Request Forgery (CSRF) in CubeWP - All-in-One Dynamic Content Framework versions up to 1.1.23 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings. The vulnerability has a low EPSS score (0.03%) and no public exploit or active exploitation has been identified.
Stored cross-site scripting in the Premium Packages plugin for WordPress allows authenticated attackers with low privileges to inject scripts that execute in other users' browsers when they view the malicious content. Versions up to 6.0.2 are affected, and no public exploit or active exploitation has been reported; EPSS estimates a 0.05% chance of exploitation.
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
A SQL Injection vulnerability (CWE-89) exists in Renzo Tejada's 'Libro de Reclamaciones y Quejas' application versions up to 0.9, allowing authenticated attackers with high privileges to execute arbitrary SQL commands. While the CVSS score is 7.6 (High), the attack requires prior authentication and high-level privileges (PR:H), significantly reducing real-world exploitability. The vulnerability impacts confidentiality (data exfiltration) and limited availability, though integrity is not affected. Without confirmed KEV status, active exploitation data, or public proof-of-concept, this represents a medium-priority issue requiring patching but not immediate emergency response.
Cross-Site Request Forgery (CSRF) in Elite Video Player for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying settings or deleting data. The vulnerability affects versions up to and including 10.0.5. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery in WP-Recall plugin for WordPress allows privilege escalation. An attacker can trick an authenticated admin into performing unintended actions, potentially gaining elevated access. No public exploit or active exploitation identified.
Cross-Site Request Forgery in Simple Keyword to Link plugin up to version 1.5 enables unauthenticated attackers to trick WordPress administrators into unknowingly modifying plugin settings by visiting a malicious page. The vulnerability carries a CVSS 4.3 medium severity, but EPSS indicates a 0.03% probability of exploitation, and no public exploit code or active exploitation is confirmed.
Authenticated low-privilege users can bypass access controls in Slack Notifications by dorzki 2.0.7 and earlier, potentially disrupting notification delivery. Exploitation requires an authenticated session with low privileges and has no direct confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Nexa Blocks WordPress plugin up to version 1.1.0 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited impact on internal systems. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
Cross-Site Request Forgery (CSRF) in Advanced Post List WordPress plugin up to version 0.5.6.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.