Wordpress Plugin
Monthly
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Una
Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.
Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated SQL injection in the Quiz And Survey Master WordPress plugin (versions 11.2.0 and earlier) lets a low-privileged Contributor-level user inject arbitrary SQL through the plugin's quiz/survey handling, exposing the entire WordPress database. The CVSS 3.1 base score is 8.5 with a scope change, reflecting that a single low-trust account can read data across the whole database rather than just plugin-scoped tables. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.
SQL injection in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through a plugin request, carrying a CVSS 3.1 base score of 9.3 (AV:N/PR:N with a changed scope and high confidentiality impact). Because Bookly is a public-facing booking form reachable by any site visitor, the flaw exposes the entire WordPress database to extraction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Thrive Quiz Builder WordPress plugin (versions 10.9.3.0 and earlier) lets remote attackers inject crafted serialized PHP objects that are deserialized by the plugin, enabling POP-chain abuse that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 with a fully network-reachable, no-privilege, no-interaction vector, making any unpatched site running the plugin a high-value target. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.
SQL injection in the Create by Mediavine (Mediavine Create) WordPress recipe plugin through version 2.5.3 allows authenticated users holding at least Contributor-level privileges to inject arbitrary SQL into backend database queries (CWE-89). Successful exploitation exposes the full WordPress database - including user credentials, secret keys, and site content - and the CVSS 3.1 scope-changed vector (S:C) indicates impact beyond the plugin's own security context. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site.
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the `ninja-forms/submissions-table` Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via `wp_localize_script`, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.
Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary file upload in the MapSVG WordPress plugin (all versions through 8.14.0) lets authenticated Administrator-level users bypass file-type validation in the SVGFile constructor and upload arbitrary files, potentially achieving remote code execution on the host. The flaw stems from an incorrect conditional that skips validation entirely rather than enforcing it. Reported by Wordfence with a CVSS 3.1 base score of 7.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions through 2.4.18) lets fully unauthenticated attackers persist arbitrary JavaScript through the form's 'digitalSignature' field value, which is neither sanitized on input nor escaped on output. Because the form-submission nonce is exposed on any page rendering the form shortcode, the normal anti-CSRF barrier provides no protection, and the injected script executes in the browser of any user (including administrators) who later views the affected page. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a practical scan-and-spray candidate.
Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users holding the wpf_manage_funnels capability — typically the plugin's Funnel Manager custom role — rewrite the global wp_user_roles option and grant their own role full administrator capabilities. All versions up to and including 3.12.8 are affected, and Wordfence rates it CVSS 8.8 (High). No public exploit has been identified at time of analysis, but the root cause is trivial (an unvalidated option name reaching update_option()), making reliable weaponization straightforward for a low-privileged insider.
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable through a Cross-Site Request Forgery flaw in the execTemplate function, where missing nonce validation lets an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link supply a php://filter stream wrapper as the 'template' parameter, bypassing path validation and reaching a PHP include sink to execute arbitrary code. The chain converts a classic CSRF (CWE-352) into full server compromise, carrying CVSS 8.8 (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file deletion in the Uncanny Automator WordPress plugin (all versions through 7.3.1.4) lets unauthenticated attackers delete any file on the server via untrusted PHP object deserialization in the fr_token function, and deleting a critical file such as wp-config.php can pivute WordPress into an installation/setup state that yields remote code execution. Exploitation is gated by a specific setup: a Forminator form must be connected to an Uncanny Automator recipe whose trigger is configured for 'Everyone', which is what exposes the deserialization sink to anonymous form submissions. A self-contained gadget chain via Action_Helpers_Email::__destruct() ships inside the plugin, so no external gadget library is needed; reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.
SQL injection in ThemeHunk's Advance Product Search - Voice & Ajax Search for WooCommerce plugin (all versions ≤ 1.4.4) lets unauthenticated attackers inject arbitrary SQL through the 's' and 'match' search parameters, enabling extraction of sensitive database contents such as user credentials and order data. The flaw stems from unescaped, unprepared query construction in the plugin's AJAX search backend and is remotely exploitable without authentication or user interaction. Reported by Wordfence; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file upload in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.1) allows remote attackers to place attacker-controlled files on the server via the image caching path, potentially escalating to remote code execution. The root cause is incomplete file-type validation in the plugin's image cache handling, where a cached file's extension was trusted rather than re-derived from the actual validated image type. Reported by Wordfence and fixed upstream; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-Site Request Forgery in the Woosalam (ووسلام - همگام سازی ووکامرس و باسلام) WooCommerce-to-Basalam sync plugin for WordPress lets a remote attacker forge state-changing requests that a logged-in victim's browser executes, affecting all versions from an unspecified initial release through 1.9.1. Because the plugin fails to validate request authenticity (CWE-352), an attacker who lures an authenticated user to a malicious page can trigger high-integrity changes with no attacker authentication required (CVSS 7.1). No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Blind SQL injection in the persian-gravity-forms WordPress plugin (گرویتی فرم فارسی) affects all versions up to and including 3.0.2, allowing a high-privilege authenticated attacker to inject arbitrary SQL through unsanitized input and blindly extract database contents. The flaw was reported by Patchstack and carries a CVSS 7.6 due to a changed scope and high confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the ShapedPlugin Real Testimonials (testimonial-free) WordPress plugin affects all versions up to and including 3.1.15, allowing a high-privileged authenticated user to inject serialized PHP objects that the plugin unsafely deserializes. Depending on gadget chains present in WordPress core, other active plugins, or themes, this can escalate to arbitrary code execution, data disclosure, or site compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the ICS Calendar WordPress plugin (by Room 34 Creative Services) affects all versions from initial release through 12.1.1, letting an attacker craft a malicious URL that, when opened by a victim, injects arbitrary script into the rendered page. Because the CVSS scope is changed (S:C), successful execution can affect resources beyond the vulnerable component, including a logged-in administrator's WordPress session. No public exploit identified at time of analysis, and it is not on the CISA KEV list.
Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
Una
Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
Cross-site request forgery in the MailPoet WordPress plugin (versions 5.30.0 through 5.33.0) allows a remote attacker to trick an authenticated victim into submitting forged state-changing requests, producing limited confidentiality, integrity, and availability impact with a scope change per the CVSS vector. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Exploitation requires user interaction (UI:R), so a logged-in administrator or user must be lured into visiting an attacker-controlled page.
Cross-Site Request Forgery in the WordPress plugin 'Popup for CF7 with Sweet Alert' (by Metin Saraç) through version 1.6.5 allows a remote unauthenticated attacker to trick an authenticated site user or administrator into unknowingly submitting state-changing plugin requests. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-change impact but requires victim interaction (clicking an attacker-controlled link/page). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Cross-Site Request Forgery in the Avada Core (fusion-core) WordPress plugin at versions 5.15.6 and earlier lets a remote attacker forge privileged state-changing requests by tricking an authenticated user into visiting a malicious page. The flaw (CWE-352) carries a vendor/Patchstack CVSS of 9.6 with a scope-changing, high-impact vector and requires victim interaction (UI:R) but no attacker authentication (PR:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated administrator write files of dangerous types into a web-accessible path, enabling web shell deployment and full site/server compromise. Reported by Patchstack, it carries a CVSS 9.1 (scope-changed) rating, but exploitation requires high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated SQL injection in the Quiz And Survey Master WordPress plugin (versions 11.2.0 and earlier) lets a low-privileged Contributor-level user inject arbitrary SQL through the plugin's quiz/survey handling, exposing the entire WordPress database. The CVSS 3.1 base score is 8.5 with a scope change, reflecting that a single low-trust account can read data across the whole database rather than just plugin-scoped tables. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.
SQL injection in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through a plugin request, carrying a CVSS 3.1 base score of 9.3 (AV:N/PR:N with a changed scope and high confidentiality impact). Because Bookly is a public-facing booking form reachable by any site visitor, the flaw exposes the entire WordPress database to extraction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Thrive Quiz Builder WordPress plugin (versions 10.9.3.0 and earlier) lets remote attackers inject crafted serialized PHP objects that are deserialized by the plugin, enabling POP-chain abuse that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 with a fully network-reachable, no-privilege, no-interaction vector, making any unpatched site running the plugin a high-value target. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the WordPress "Advanced Views" plugin (by wplake) affects all versions up to and including 3.8.11, allowing an authenticated user with only Subscriber-level privileges to inject and execute arbitrary code (CWE-94) on the server. Rated CVSS 9.9 by Patchstack because a low-privilege account - trivially self-registered on many WordPress sites - can achieve full compromise with no user interaction. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in the WP BASE Booking WordPress plugin (versions 6.3.1 and earlier) lets a low-privileged authenticated Subscriber elevate their permissions to a higher-privileged role. Because the CVSS vector is AV:N/PR:L with high confidentiality, integrity, and availability impact, an attacker holding any low-level account - trivially obtained on sites with open registration - can gain administrative-level control over the booking system and potentially the wider WordPress instance. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.
Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Improper authorization in the WP Booking System WordPress plugin (all versions before 5.12.8.1) lets low-privileged, authenticated Subscriber-level accounts perform actions or modify data they should not be able to reach, reflecting an integrity-focused broken access control weakness. Because self-registration is common on WordPress sites, any user able to obtain a Subscriber account can abuse the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.1 (high), driven by high integrity impact with only low privilege requirements over the network.
Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.
SQL injection in the Create by Mediavine (Mediavine Create) WordPress recipe plugin through version 2.5.3 allows authenticated users holding at least Contributor-level privileges to inject arbitrary SQL into backend database queries (CWE-89). Successful exploitation exposes the full WordPress database - including user credentials, secret keys, and site content - and the CVSS 3.1 scope-changed vector (S:C) indicates impact beyond the plugin's own security context. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
Unauthenticated arbitrary file upload in the rtCamp GoDAM WordPress plugin (versions ≤ 1.12.2) allows remote attackers to plant executable files and likely achieve remote code execution. The flaw lives in the plugin's WPForms video-field integration, which bypasses WordPress's built-in upload sanitization by trusting the client-supplied Content-Type header and moving raw uploads into a web-served directory. No public exploit code has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority patch for any exposed site.
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the `ninja-forms/submissions-table` Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via `wp_localize_script`, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.
Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary file upload in the MapSVG WordPress plugin (all versions through 8.14.0) lets authenticated Administrator-level users bypass file-type validation in the SVGFile constructor and upload arbitrary files, potentially achieving remote code execution on the host. The flaw stems from an incorrect conditional that skips validation entirely rather than enforcing it. Reported by Wordfence with a CVSS 3.1 base score of 7.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Remote code execution is possible in the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration) in all versions through 4.16.18, where the DigitalProducts UploadHandler unconditionally registers an upload_mimes filter that whitelists executable extensions (.exe, .apk, .msi) across every WordPress upload context site-wide. Authenticated attackers with author-level access or above (per CVSS PR:L) can leverage this expanded MIME allowlist to upload executable files, leading to code execution. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions through 2.4.18) lets fully unauthenticated attackers persist arbitrary JavaScript through the form's 'digitalSignature' field value, which is neither sanitized on input nor escaped on output. Because the form-submission nonce is exposed on any page rendering the form shortcode, the normal anti-CSRF barrier provides no protection, and the injected script executes in the browser of any user (including administrators) who later views the affected page. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a practical scan-and-spray candidate.
Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users holding the wpf_manage_funnels capability — typically the plugin's Funnel Manager custom role — rewrite the global wp_user_roles option and grant their own role full administrator capabilities. All versions up to and including 3.12.8 are affected, and Wordfence rates it CVSS 8.8 (High). No public exploit has been identified at time of analysis, but the root cause is trivial (an unvalidated option name reaching update_option()), making reliable weaponization straightforward for a low-privileged insider.
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable through a Cross-Site Request Forgery flaw in the execTemplate function, where missing nonce validation lets an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link supply a php://filter stream wrapper as the 'template' parameter, bypassing path validation and reaching a PHP include sink to execute arbitrary code. The chain converts a classic CSRF (CWE-352) into full server compromise, carrying CVSS 8.8 (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file deletion in the Uncanny Automator WordPress plugin (all versions through 7.3.1.4) lets unauthenticated attackers delete any file on the server via untrusted PHP object deserialization in the fr_token function, and deleting a critical file such as wp-config.php can pivute WordPress into an installation/setup state that yields remote code execution. Exploitation is gated by a specific setup: a Forminator form must be connected to an Uncanny Automator recipe whose trigger is configured for 'Everyone', which is what exposes the deserialization sink to anonymous form submissions. A self-contained gadget chain via Action_Helpers_Email::__destruct() ships inside the plugin, so no external gadget library is needed; reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.
SQL injection in ThemeHunk's Advance Product Search - Voice & Ajax Search for WooCommerce plugin (all versions ≤ 1.4.4) lets unauthenticated attackers inject arbitrary SQL through the 's' and 'match' search parameters, enabling extraction of sensitive database contents such as user credentials and order data. The flaw stems from unescaped, unprepared query construction in the plugin's AJAX search backend and is remotely exploitable without authentication or user interaction. Reported by Wordfence; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file upload in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.1) allows remote attackers to place attacker-controlled files on the server via the image caching path, potentially escalating to remote code execution. The root cause is incomplete file-type validation in the plugin's image cache handling, where a cached file's extension was trusted rather than re-derived from the actual validated image type. Reported by Wordfence and fixed upstream; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-Site Request Forgery in the Woosalam (ووسلام - همگام سازی ووکامرس و باسلام) WooCommerce-to-Basalam sync plugin for WordPress lets a remote attacker forge state-changing requests that a logged-in victim's browser executes, affecting all versions from an unspecified initial release through 1.9.1. Because the plugin fails to validate request authenticity (CWE-352), an attacker who lures an authenticated user to a malicious page can trigger high-integrity changes with no attacker authentication required (CVSS 7.1). No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Blind SQL injection in the persian-gravity-forms WordPress plugin (گرویتی فرم فارسی) affects all versions up to and including 3.0.2, allowing a high-privilege authenticated attacker to inject arbitrary SQL through unsanitized input and blindly extract database contents. The flaw was reported by Patchstack and carries a CVSS 7.6 due to a changed scope and high confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the ShapedPlugin Real Testimonials (testimonial-free) WordPress plugin affects all versions up to and including 3.1.15, allowing a high-privileged authenticated user to inject serialized PHP objects that the plugin unsafely deserializes. Depending on gadget chains present in WordPress core, other active plugins, or themes, this can escalate to arbitrary code execution, data disclosure, or site compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the ICS Calendar WordPress plugin (by Room 34 Creative Services) affects all versions from initial release through 12.1.1, letting an attacker craft a malicious URL that, when opened by a victim, injects arbitrary script into the rendered page. Because the CVSS scope is changed (S:C), successful execution can affect resources beyond the vulnerable component, including a logged-in administrator's WordPress session. No public exploit identified at time of analysis, and it is not on the CISA KEV list.
Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.