Wordpress Plugin
Monthly
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
Cross-Site Request Forgery in Booqable Rental WordPress plugin up to version 2.4.20 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing settings or making unauthorized modifications. The vulnerability has a low EPSS score (0.03%) and no public exploit or active exploitation has been identified.
An open redirect vulnerability in the WP Gravity Forms Constant Contact Plugin up to version 1.1.0 allows phishing attacks by redirecting users to untrusted sites. The vulnerability requires user interaction and has a low CVSS score of 4.7, with no evidence of active exploitation or public exploit code.
Open redirect vulnerability in WP Gravity Forms Salesforce plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirect functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.
Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Cross-Site Request Forgery (CSRF) in Layouts for Elementor plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 1.11. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-site request forgery in the WordPress plugin Custom Bulk/Quick Edit up to version 1.6.10 allows an attacker to trick an authenticated administrator into performing unauthorized bulk edit actions on posts or settings. The flaw resides in missing CSRF protection on plugin actions. No active exploitation or public exploit code is known, and the EPSS score is very low (0.03%), indicating limited real-world risk.
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.
Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.
Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Missing authorization in the Wordapp plugin for WordPress (up to version 1.7.0) allows authenticated users to access restricted data, resulting in low-impact information disclosure. No active exploitation or public exploit code has been reported.
Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
A Cross-Site Request Forgery vulnerability in the Global Translator WordPress plugin through version 2.0.2 allows attackers to perform unauthorized actions on behalf of authenticated users, potentially modifying plugin settings or disrupting service. Exploitation requires an administrator to visit a malicious website while logged in. No public exploit code or active exploitation has been identified.
Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Cross-Site Request Forgery (CSRF) in the Bitly URL Shortener WordPress plugin through version 1.3.3 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by crafting a malicious link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
A security vulnerability in Missing Authorization vulnerability in eleopard Behance Portfolio Manager (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Server-Side Request Forgery (SSRF) in SocialMark WordPress plugin up to version 2.0.7 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery in HR Management Lite (WordPress plugin by weblizar) up to version 3.3 allows an unauthenticated attacker to trick an authenticated admin into performing unintended actions, such as modifying HR records. No active exploitation or public proof-of-concept known at time of analysis. The vulnerability has a CVSS score of 4.3, with low integrity impact and no confidentiality or availability impact.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in GPP Slideshow WordPress plugin up to version 1.3.5 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of slideshow settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).
A Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin versions up to 1.5 allows unauthenticated attackers to perform unauthorized actions via crafted requests. While the CVE description anomalously mentions SQL Injection alongside CSRF, the CVSS vector (CWE-352: CSRF) and vector string indicate the primary threat is CSRF with consequential impacts on confidentiality (High) and availability (Low). The vulnerability requires user interaction (UI:R) and affects confidentiality significantly, making it a material risk for WordPress installations using this plugin, particularly if no active mitigation or patch is available.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
A cross-site scripting vulnerability in Soli WP Mail Options allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CSRF vulnerability in mail250 Free WP Mail SMTP (versions up to 1.0) that enables stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts via crafted requests. The vulnerability requires user interaction (UI:R) but has network-based attack vector (AV:N) with low complexity (AC:L), affecting WordPress installations using this email plugin. While CVSS 7.1 indicates medium-high severity with confidentiality, integrity, and availability impact, real-world exploitation depends on KEV status, EPSS probability, and public POC availability-data not provided in the source material.
Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.
Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon (versions up to 2.0) that enables Stored XSS attacks. An unauthenticated attacker can craft a malicious request that, when visited by a user, executes arbitrary JavaScript in the victim's browser context with access to sensitive data and session tokens. While no public exploit or KEV status confirmation is available from the provided data, the CVSS 7.1 score and Stored XSS payload persistence indicate moderate-to-high real-world risk, particularly if the plugin has significant user adoption.
Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov's Bg Orthodox Calendar plugin that enables Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions from an unspecified baseline through 0.13.10, allowing unauthenticated attackers over the network to inject and store malicious scripts that execute in users' browsers with moderate impact to confidentiality, integrity, and availability. The CVSS 7.1 score reflects the combination of network attack vector with user interaction requirement; real-world exploitation risk depends on whether this vulnerability is actively exploited or has public proof-of-concept code available.
Cross-Site Request Forgery (CSRF) vulnerability in the wphobby Backwp WordPress plugin (versions through 2.0.2) that enables path traversal attacks. An unauthenticated remote attacker can exploit this via a crafted web request to perform unauthorized actions and potentially access sensitive files outside intended directories. While the CVSS score of 7.4 indicates high severity with availability impact, the vulnerability requires user interaction (UI:R) and affects availability rather than confidentiality or integrity, suggesting moderate real-world exploitability.
Cross-Site Request Forgery (CSRF) in CubePoints WordPress plugin up to version 3.2.1 allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. The vulnerability requires user interaction (clicking a crafted link) and has low exploitation probability (EPSS 0.03%). No public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.
Cross-Site Request Forgery (CSRF) in Quick Event Calendar for WordPress up to version 1.4.9 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying calendar settings or events, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Settings manipulation in Seerox WP Media File Type Manager versions up to 2.3.0 allows unauthenticated attackers to change plugin settings by tricking an administrator into clicking a crafted link. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.03%).
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in FastBook 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
SQL Injection vulnerability in Nir Complete Google SEO Scan plugin (versions up to 3.5.1) that allows authenticated attackers with high privileges to execute arbitrary SQL commands against the database. While the CVSS score is 7.6 (high), the attack requires administrative credentials and does not enable data modification, limiting real-world impact to information disclosure and service degradation. No active exploitation in the wild has been confirmed at this time.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in Pay with Contact Form 7 plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or initiating unauthorized transactions. Affected versions are through 1.0.4. No public exploit or active exploitation has been identified, and EPSS score is low (0.03%).
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Sensitive data exposure in KI Live Video Conferences WordPress plugin up to version 5.5.15 allows unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability has a low EPSS score (0.07%) and no public exploit or active exploitation has been identified.
SQL injection vulnerability in the WP Post Corrector WordPress plugin (versions up to 1.0.2) that allows authenticated attackers with high privileges to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure and limited service disruption. The vulnerability requires administrator-level access to exploit, significantly limiting its immediate threat surface, though it could be chained with privilege escalation attacks.
A security vulnerability in Missing Authorization vulnerability in 6Storage 6Storage Rentals (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
PHP Local File Inclusion (LFI) vulnerability in choicehomemortgage AI Mortgage Calculator versions up to 1.0.1, caused by improper input validation on file inclusion statements. An authenticated attacker with low privileges can exploit this vulnerability over the network to read arbitrary files from the server, potentially leading to information disclosure, privilege escalation, or remote code execution. The high CVSS score of 7.5 reflects the severity of potential impacts (confidentiality, integrity, availability compromise), though the requirement for authenticated access and high attack complexity somewhat limit real-world exploitability.
Cross-site request forgery in the ThemeHigh Dynamic Pricing and Discount Rules WordPress plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. By tricking a logged-in admin into clicking a malicious link, an attacker could modify discount pricing rules without their knowledge. The vulnerability affects plugin versions up to and including 2.2.9, carries a CVSS 4.3 (Medium) score, and has a very low exploitation probability (EPSS 0.03%).
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.
Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
A reflected cross-site scripting (XSS) vulnerability exists in Daman Jeet's Real Time Validation for Gravity Forms plugin affecting versions through 1.7.0, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise user sessions, steal credentials, or deface form content due to its cross-site impact scope. While the CVSS score of 7.1 indicates moderate-to-high severity, real-world exploitation depends on form visibility and user interaction patterns.
Cross-Site Request Forgery (CSRF) in Real Time Validation for Gravity Forms plugin for WordPress allows an attacker to trick an authenticated administrator into performing unwanted actions, such as changing plugin settings. The vulnerability affects all versions up to and including 1.7.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
PHP Local File Inclusion (LFI) vulnerability in StylemixThemes Motors - Events plugin affecting versions up to 1.4.7, allowing unauthenticated remote attackers to include and execute arbitrary PHP files under certain conditions. With a CVSS score of 9.0 and network accessibility, this vulnerability enables complete system compromise through code execution. Active exploitation status and proof-of-concept availability should be verified through KEV database and security research databases.
A deserialization vulnerability in Teastudio (CVSS 8.8). High severity vulnerability requiring prompt remediation.
The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Missing authorization in Uncanny Automator for WordPress up to version 6.4.0.2 allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of automation settings or data. The vulnerability has a CVSS score of 6.5 with network attack vector and low complexity, but no public exploit or active exploitation has been identified at this time.
Missing authorization in Element Pack Pro for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized read and limited modification of data. The vulnerability affects versions before 8.0.0, with a patch available from the vendor. No public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in Element Pack Pro for WordPress allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. The vulnerability affects versions before 8.0.0 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Sunshine Photo Cart plugin for WordPress (versions ≤3.4.11) contains an improper key validation vulnerability in its password reset functionality, allowing authenticated attackers with Subscriber-level privileges to perform privilege escalation by resetting arbitrary user passwords, including administrators. With a CVSS score of 8.8 and a low attack complexity (network-accessible, no user interaction required), this vulnerability poses a critical threat to WordPress installations using this plugin. The vulnerability is likely to be actively exploited given the straightforward attack path and the high-value target (admin account takeover).
The Simple Contact Form Plugin for WordPress - WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
Cross-Site Request Forgery in Booqable Rental WordPress plugin up to version 2.4.20 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing settings or making unauthorized modifications. The vulnerability has a low EPSS score (0.03%) and no public exploit or active exploitation has been identified.
An open redirect vulnerability in the WP Gravity Forms Constant Contact Plugin up to version 1.1.0 allows phishing attacks by redirecting users to untrusted sites. The vulnerability requires user interaction and has a low CVSS score of 4.7, with no evidence of active exploitation or public exploit code.
Open redirect vulnerability in WP Gravity Forms Salesforce plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirect functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in wpdive Nexa Blocks up to version 1.1.0 enables authenticated attackers with low privileges to inject malicious scripts into pages, leading to arbitrary script execution in the browsers of users who view the contaminated content. This can result in session hijacking, phishing, or site defacement. No active exploitation or public exploit has been identified; EPSS indicates low exploitation probability.
Stored cross-site scripting in BlockStrap Page Builder - Bootstrap Blocks plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Cross-Site Request Forgery (CSRF) in Layouts for Elementor plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 1.11. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-site request forgery in the WordPress plugin Custom Bulk/Quick Edit up to version 1.6.10 allows an attacker to trick an authenticated administrator into performing unauthorized bulk edit actions on posts or settings. The flaw resides in missing CSRF protection on plugin actions. No active exploitation or public exploit code is known, and the EPSS score is very low (0.03%), indicating limited real-world risk.
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in Post Custom Templates Lite allows authenticated high-privilege attackers to inject scripts that execute in other users' browsers. Affected versions up to 1.14. No active exploitation or public exploit code identified; EPSS indicates very low exploitation likelihood.
Stored cross-site scripting in Pinterest Verify Meta Tag WordPress plugin up to version 1.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.
Cross-site scripting in the IFrame Widget WordPress plugin allows stored script injection by authenticated high-privilege users. Affected versions up to 4.1 enable attackers to execute arbitrary JavaScript in the browsers of visitors, potentially compromising user sessions or site integrity. No active exploitation or public exploit code is confirmed, and EPSS predicts low exploitation likelihood.
Stored Cross-Site Scripting (XSS) in the Responsify WP WordPress plugin version 1.9.11 and earlier allows authenticated attackers with high privileges to inject arbitrary web scripts into pages viewed by other users. The injected code executes in the victim’s browser when they access an affected page, potentially leading to session hijacking, content manipulation, or other client-side attacks. No public exploit code or active exploitation has been reported at this time.
DOM-based cross-site scripting in NickDuncan Contact Form plugin for WordPress ≤2.0.12 allows authenticated low-privilege users to inject arbitrary web scripts. When a higher-privilege user interacts with the malicious content, the script executes in their browser, potentially compromising the session. EPSS indicates very low exploitation likelihood (0.05%), and no active exploitation or public PoC is currently known.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Stored cross-site scripting in the WordPress plugin «Подсказки» от DaData.ru up to version 1.0.6 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in ACF: Yandex Maps Field plugin for WordPress up to version 1.1 allows authenticated users with high privileges to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Biographia 4.0.0 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Missing authorization in the Wordapp plugin for WordPress (up to version 1.7.0) allows authenticated users to access restricted data, resulting in low-impact information disclosure. No active exploitation or public exploit code has been reported.
Stored cross-site scripting in Powie's Uptime Robot WordPress plugin up to version 0.9.7 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Deetronix Booking Ultra Pro WordPress plugin 1.1.20 and earlier allows authenticated high-privilege attackers to inject arbitrary web scripts. Users who view affected plugin pages can trigger execution, leading to session hijacking or malicious actions in their browser context. No active exploitation or public exploit code has been identified, and EPSS indicates a very low exploitation probability (0.04%, 13th percentile).
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
Stored cross-site scripting in WP Featured Content Slider 2.6 and earlier allows authenticated users with high privileges to inject malicious scripts that execute when other users view the slider. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
A Cross-Site Request Forgery vulnerability in the Global Translator WordPress plugin through version 2.0.2 allows attackers to perform unauthorized actions on behalf of authenticated users, potentially modifying plugin settings or disrupting service. Exploitation requires an administrator to visit a malicious website while logged in. No public exploit code or active exploitation has been identified.
Stored cross-site scripting in Global Translator WordPress plugin up to version 2.0.2 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified.
Cross-Site Request Forgery (CSRF) in the Bitly URL Shortener WordPress plugin through version 1.3.3 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by crafting a malicious link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Stored cross-site scripting in Elegant Visitor Counter plugin for WordPress up to version 3.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in AppBanners WordPress plugin up to version 1.5.14 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in YouTube Simple Gallery WordPress plugin up to version 2.2.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
A security vulnerability in Missing Authorization vulnerability in eleopard Behance Portfolio Manager (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Server-Side Request Forgery (SSRF) in SocialMark WordPress plugin up to version 2.0.7 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Cross-Site Request Forgery in HR Management Lite (WordPress plugin by weblizar) up to version 3.3 allows an unauthenticated attacker to trick an authenticated admin into performing unintended actions, such as modifying HR records. No active exploitation or public proof-of-concept known at time of analysis. The vulnerability has a CVSS score of 4.3, with low integrity impact and no confidentiality or availability impact.
Stored cross-site scripting (XSS) in The Holiday Calendar WordPress plugin up to version 1.18.2.1 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in GPP Slideshow WordPress plugin up to version 1.3.5 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of slideshow settings. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting in the Read More Login WordPress plugin (≤2.0.3) allows high-privileged attackers to inject scripts executed by other users. Exploitation requires administrator access and user interaction, and no public exploit or active exploitation has been identified. The vulnerability poses limited risk due to required privileges and very low exploitation probability (EPSS 0.04%).
A Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin versions up to 1.5 allows unauthenticated attackers to perform unauthorized actions via crafted requests. While the CVE description anomalously mentions SQL Injection alongside CSRF, the CVSS vector (CWE-352: CSRF) and vector string indicate the primary threat is CSRF with consequential impacts on confidentiality (High) and availability (Low). The vulnerability requires user interaction (UI:R) and affects confidentiality significantly, making it a material risk for WordPress installations using this plugin, particularly if no active mitigation or patch is available.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
A cross-site scripting vulnerability in Soli WP Mail Options allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CSRF vulnerability in mail250 Free WP Mail SMTP (versions up to 1.0) that enables stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts via crafted requests. The vulnerability requires user interaction (UI:R) but has network-based attack vector (AV:N) with low complexity (AC:L), affecting WordPress installations using this email plugin. While CVSS 7.1 indicates medium-high severity with confidentiality, integrity, and availability impact, real-world exploitation depends on KEV status, EPSS probability, and public POC availability-data not provided in the source material.
Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.
Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon (versions up to 2.0) that enables Stored XSS attacks. An unauthenticated attacker can craft a malicious request that, when visited by a user, executes arbitrary JavaScript in the victim's browser context with access to sensitive data and session tokens. While no public exploit or KEV status confirmation is available from the provided data, the CVSS 7.1 score and Stored XSS payload persistence indicate moderate-to-high real-world risk, particularly if the plugin has significant user adoption.
Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov's Bg Orthodox Calendar plugin that enables Stored Cross-Site Scripting (XSS) attacks. The vulnerability affects all versions from an unspecified baseline through 0.13.10, allowing unauthenticated attackers over the network to inject and store malicious scripts that execute in users' browsers with moderate impact to confidentiality, integrity, and availability. The CVSS 7.1 score reflects the combination of network attack vector with user interaction requirement; real-world exploitation risk depends on whether this vulnerability is actively exploited or has public proof-of-concept code available.
Cross-Site Request Forgery (CSRF) vulnerability in the wphobby Backwp WordPress plugin (versions through 2.0.2) that enables path traversal attacks. An unauthenticated remote attacker can exploit this via a crafted web request to perform unauthorized actions and potentially access sensitive files outside intended directories. While the CVSS score of 7.4 indicates high severity with availability impact, the vulnerability requires user interaction (UI:R) and affects availability rather than confidentiality or integrity, suggesting moderate real-world exploitability.
Cross-Site Request Forgery (CSRF) in CubePoints WordPress plugin up to version 3.2.1 allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. The vulnerability requires user interaction (clicking a crafted link) and has low exploitation probability (EPSS 0.03%). No public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.
Cross-Site Request Forgery (CSRF) in Quick Event Calendar for WordPress up to version 1.4.9 allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying calendar settings or events, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Settings manipulation in Seerox WP Media File Type Manager versions up to 2.3.0 allows unauthenticated attackers to change plugin settings by tricking an administrator into clicking a crafted link. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.03%).
DOM-Based Cross-Site Scripting (XSS) in Simple Google Static Map plugin for WordPress versions up to 1.0.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Cross-Site Request Forgery (CSRF) in FastBook 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
SQL Injection vulnerability in Nir Complete Google SEO Scan plugin (versions up to 3.5.1) that allows authenticated attackers with high privileges to execute arbitrary SQL commands against the database. While the CVSS score is 7.6 (high), the attack requires administrative credentials and does not enable data modification, limiting real-world impact to information disclosure and service degradation. No active exploitation in the wild has been confirmed at this time.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in Pay with Contact Form 7 plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or initiating unauthorized transactions. Affected versions are through 1.0.4. No public exploit or active exploitation has been identified, and EPSS score is low (0.03%).
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Sensitive data exposure in KI Live Video Conferences WordPress plugin up to version 5.5.15 allows unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability has a low EPSS score (0.07%) and no public exploit or active exploitation has been identified.
SQL injection vulnerability in the WP Post Corrector WordPress plugin (versions up to 1.0.2) that allows authenticated attackers with high privileges to execute arbitrary SQL queries, potentially leading to unauthorized data disclosure and limited service disruption. The vulnerability requires administrator-level access to exploit, significantly limiting its immediate threat surface, though it could be chained with privilege escalation attacks.
A security vulnerability in Missing Authorization vulnerability in 6Storage 6Storage Rentals (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
PHP Local File Inclusion (LFI) vulnerability in choicehomemortgage AI Mortgage Calculator versions up to 1.0.1, caused by improper input validation on file inclusion statements. An authenticated attacker with low privileges can exploit this vulnerability over the network to read arbitrary files from the server, potentially leading to information disclosure, privilege escalation, or remote code execution. The high CVSS score of 7.5 reflects the severity of potential impacts (confidentiality, integrity, availability compromise), though the requirement for authenticated access and high attack complexity somewhat limit real-world exploitability.
Cross-site request forgery in the ThemeHigh Dynamic Pricing and Discount Rules WordPress plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators. By tricking a logged-in admin into clicking a malicious link, an attacker could modify discount pricing rules without their knowledge. The vulnerability affects plugin versions up to and including 2.2.9, carries a CVSS 4.3 (Medium) score, and has a very low exploitation probability (EPSS 0.03%).
Stored cross-site scripting in The Plus Addons for Elementor Page Builder Lite up to version 6.2.7 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in PickPlugins Wishlist plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into wishlist pages. Affects versions through 1.0.43. No public exploit or active exploitation identified.
Stored cross-site scripting in WidgetKit for Elementor allows authenticated attackers with contributor-level access to inject malicious scripts via widget settings. The vulnerability affects all versions up to 2.5.4 and can lead to session hijacking or defacement when an admin views the compromised page. No public exploit or active exploitation has been identified.
Stored cross-site scripting in Ocean Extra WordPress plugin up to version 2.4.8 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Nasa Core WordPress plugin before 6.4.1 allows authenticated attackers with contributor-level access to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified, and EPSS score is low (0.05%).
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
A reflected cross-site scripting (XSS) vulnerability exists in Daman Jeet's Real Time Validation for Gravity Forms plugin affecting versions through 1.7.0, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise user sessions, steal credentials, or deface form content due to its cross-site impact scope. While the CVSS score of 7.1 indicates moderate-to-high severity, real-world exploitation depends on form visibility and user interaction patterns.
Cross-Site Request Forgery (CSRF) in Real Time Validation for Gravity Forms plugin for WordPress allows an attacker to trick an authenticated administrator into performing unwanted actions, such as changing plugin settings. The vulnerability affects all versions up to and including 1.7.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
PHP Local File Inclusion (LFI) vulnerability in StylemixThemes Motors - Events plugin affecting versions up to 1.4.7, allowing unauthenticated remote attackers to include and execute arbitrary PHP files under certain conditions. With a CVSS score of 9.0 and network accessibility, this vulnerability enables complete system compromise through code execution. Active exploitation status and proof-of-concept availability should be verified through KEV database and security research databases.
A deserialization vulnerability in Teastudio (CVSS 8.8). High severity vulnerability requiring prompt remediation.
The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Missing authorization in Uncanny Automator for WordPress up to version 6.4.0.2 allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of automation settings or data. The vulnerability has a CVSS score of 6.5 with network attack vector and low complexity, but no public exploit or active exploitation has been identified at this time.
Missing authorization in Element Pack Pro for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized read and limited modification of data. The vulnerability affects versions before 8.0.0, with a patch available from the vendor. No public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in Element Pack Pro for WordPress allows an attacker to perform unauthorized actions on behalf of an authenticated administrator. The vulnerability affects versions before 8.0.0 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Sunshine Photo Cart plugin for WordPress (versions ≤3.4.11) contains an improper key validation vulnerability in its password reset functionality, allowing authenticated attackers with Subscriber-level privileges to perform privilege escalation by resetting arbitrary user passwords, including administrators. With a CVSS score of 8.8 and a low attack complexity (network-accessible, no user interaction required), this vulnerability poses a critical threat to WordPress installations using this plugin. The vulnerability is likely to be actively exploited given the straightforward attack path and the high-value target (admin account takeover).
The Simple Contact Form Plugin for WordPress - WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.