WordPress
Monthly
Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated remote code execution in the AcyMailing SMTP Newsletter WordPress plugin (versions 11.0.5 and earlier) allows a remote attacker to execute arbitrary code on the underlying server, leading to full site compromise. The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating no authentication or user interaction is required, though the high attack complexity (AC:H) signals that reliable exploitation likely depends on a specific precondition, application state, or configuration that the attacker must arrange or wait for. No public exploit code is currently identified, and the vulnerability is not listed in CISA KEV.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and including 2.5.2 lets an authenticated low-privileged account - specifically a Subscriber - reach higher-privileged roles, giving full compromise of the site's confidentiality, integrity, and availability (CVSS 3.1 base 7.5, High). The advisory-supplied vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attack is network-reachable and needs no victim interaction, but the High Attack Complexity rating reflects a non-trivial precondition (a specific plugin state, ordering, or crafted import payload) that limits how reliably it can be pulled off; it does require the attacker to already hold a Subscriber account, which is trivial on sites with open registration enabled. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as a targeted-risk rather than a mass-scanning risk; no EPSS probability was supplied with this record.
SQL injection in GamiPress WordPress plugin versions 8.0.2 and earlier allows unauthenticated attackers to read sensitive data from the database. Our independent assessment indicates no user interaction or authentication is required (PR:N), though the originally provided CVSS vector specifies PR:L, creating a discrepancy that should be verified with the vendor. No public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.
PHP object injection in the 10Web Booster WordPress plugin (versions up to 2.33.6) allows an authenticated Contributor to inject a malicious PHP object, potentially leading to remote code execution if a suitable gadget chain is present. The vulnerability is network-exploitable, requires no user interaction, and has a CVSS score of 8.8, but exploitation depends on the availability of a POP chain within the plugin or other installed components. No public exploit code has been identified at time of analysis.
GravityExport Lite for Gravity Forms versions up to and including 2.7.2 contains a broken access control vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass authorization and access sensitive export data, resulting in high confidentiality impact. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a low-complexity, network-exploitable flaw with no integrity or availability impact. Exploitation requires the plugin to be installed on a site with Gravity Forms, but no authentication or user interaction is needed; no public exploit code is currently identified.
Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim loads a page rendering the malicious content, with CVSS 3.1 scoring it 7.1 High due largely to scope change and unauthenticated reach. Exploitation requires user interaction (UI:R) and is most realistic on sites that accept untrusted or public review submissions or otherwise render attacker-controlled input to a privileged viewer, and there is no public exploit identified at time of analysis. Impact is limited to the browser context, such as session or credential theft and action forgery, rather than direct server compromise.
PHP object injection in the WordPress plugin SEO Plugin by Squirrly SEO (through version 14.2.5) allows an authenticated attacker with only Contributor-level access to feed crafted serialized data into PHP's unserialize(), which can escalate to remote code execution, arbitrary file operations, or SQL injection if a usable POP gadget chain is reachable in the plugin, WordPress core, or another installed plugin. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is a genuine high-priority issue, but the practical blast radius depends on two prerequisites: the site must permit untrusted or self-registered Contributor accounts, and a viable gadget chain must exist. No public exploit code has been identified at time of analysis and the vulnerability is not known to be actively exploited (not in CISA KEV); it is not exploitable by fully unauthenticated visitors.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
Cross-site scripting (XSS) in the WP Statistics WordPress plugin (versions 14.16.13 and earlier) enables remote, unauthenticated attackers to inject malicious scripts into web pages. Exploitation requires a victim to interact with a crafted link or page, after which the script executes in the victim's browser context, potentially leading to session hijacking or data theft. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
Unauthenticated cross-site scripting in the WordPress plugin Notification for Telegram (versions up to and including 3.5.2) lets a remote attacker inject script that executes in a victim's browser when the crafted content is rendered. No authentication is required to deliver the payload (PR:N), but exploitation depends on a logged-in or administrative user visiting the page where the injected script is displayed (UI:R), and the resulting impact is limited to the client side with low confidentiality, integrity, and availability effects under a scope change (S:C). No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); EPSS data was not provided, so no exploitation-probability figure is asserted here.
Unauthenticated cross-site scripting in JW Player for WordPress 2.3.11 and earlier allows remote attackers to inject script into a victim's browser when the victim interacts with a crafted link or attacker-influenced page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) reflects a network-reachable, low-complexity flaw that requires no attacker authentication but does require user interaction; successful exploitation runs script in the victim site's origin due to scope change. The issue is reported via Patchstack, and no public exploit or CISA KEV active-exploitation confirmation was provided at time of analysis.
SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. The supplied base CVSS is 7.6, and the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, while the provided NVD-style vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L.
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they are tricked into clicking a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring user interaction but no authentication, with a scope change and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Authentication bypass in the GiveWP WordPress donation plugin (all versions through 4.16.9) allows remote, unauthenticated attackers to satisfy the plugin's credential/equivalence check with crafted input and reach privileged plugin functionality on any affected site. Scoring CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires only that the plugin be installed and reachable - no account, no privileges, and no victim interaction - with high confidentiality and integrity impact, which makes automated scanning of WordPress installs a realistic attack model. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the severity and trivial preconditions rather than observed exploitation.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Stored cross-site scripting in the Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 lets unauthenticated attackers upload a file whose contents are never validated and which the plugin then serves back with an attacker-controlled content type, so the embedded JavaScript executes in the browser of any user who opens the uploaded file's URL. Exploitation requires the target site to expose the plugin's file storage/upload feature and depends on a victim opening the attacker-supplied file link (UI:R), so it is not an automatic drive-by compromise; no public exploit code was identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none'. Sites running version 4.13.1 or later are not affected, and the vendor has released a fix.
Stored cross-site scripting in the WP Mobile Menu WordPress plugin (versions 2.7.4 up to but not including 2.9) lets an attacker import arbitrary plugin settings through a forged cross-site request in a logged-in administrator's session, because the settings-import routine does not correctly verify its nonce. The imported values are then rendered unescaped to every site visitor, so the injected script persists and executes for all users until the malicious setting is removed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the attacker needs no account of their own but must socially engineer a privileged, authenticated admin into loading the crafted request; there is no public exploit code identified at time of analysis, exploitation has not been observed, and patch status is vendor-released version 2.9.
Stored cross-site scripting in the Robin Image Optimizer WordPress plugin (versions 2.0.0 up to but not including 2.0.8) lets unauthenticated users submit content that is persisted and later rendered as script in the browser of anyone viewing the affected page, including administrators. The flaw is conditional: the bundled HTML parser only re-emits unescaped values into element attributes when the plugin's non-default image delivery mode is enabled, so installations running the default mode are not exposed. Vendor-released patch: 2.0.8; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none and the issue as not automatable, making this a real but situational stored-XSS risk rather than an emergency.
Authenticated plugin installation in the Vayu X WordPress theme before 1.0.6 allows any logged-in user - even a Subscriber - to install and activate arbitrary plugins hosted on the WordPress.org repository. The theme's AJAX action omits a capability check (CWE-284) and leaks its guarding nonce to every authenticated user, so the nonce provides no protection whatsoever; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) reflects high integrity impact with no user interaction required. Exploitation is limited to WordPress.org-hosted plugins rather than arbitrary code upload, so maximum impact depends on chaining to a vulnerable installable plugin; no public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and CISA SSVC rates exploitation as none and automatable as no.
Stored cross-site scripting in the WordPress plugin All in One Files Upload (versions 2.0.3 through 2.0.16) lets unauthenticated visitors upload SVG files containing active content that executes in the site's origin when a victim opens or previews the file, potentially handing an attacker administrator-level control of the site if a privileged user is the one who opens it. Exploitation requires no authentication (CVSS vector PR:N) and no non-default configuration, since the plugin itself whitelists SVG uploads and fails to verify the authenticity of its public upload requests, but it does require victim interaction (UI:R) and is assessed as not automatable per SSVC. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, though independent scoring disagrees with the vendor-side 8.8 rating: our assessment scores scope change with limited confidentiality and integrity impact (S:C/C:L/I:L/A:N) because the realized impact depends entirely on a privileged victim opening the stored file, which is why the urgency signals conflict.
Unauthenticated arbitrary file upload in the Zella WordPress theme before version 2.6.3 lets remote attackers write arbitrary files - including PHP - into the site by abusing a font upload action that performs no capability or nonce check, yielding full remote code execution with a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every WordPress installation running this theme at a version below 2.6.3 in its default configuration is exposed; no login, user interaction, or non-default setting is required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but CISA's SSVC assessment flags the flaw as fully automatable with total technical impact, so rapid weaponization should be assumed. The vendor has released a fix in version 2.6.3.
Privilege escalation in the WP User Frontend WordPress plugin before 4.3.12 lets unauthenticated visitors tamper with the role value submitted by the plugin's front-end registration form and create an account with elevated privileges such as Editor (the administrator role cannot be obtained this way). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms unauthenticated remote exploitation with no user interaction, but the AC:H reflects a narrow environmental precondition: the site must run on a PHP build where the sodium (libsodium) extension is unavailable, and a public registration page must be configured through the plugin. No public exploit code has been identified at time of analysis, and the SSVC assessment records Exploitation: none; impact is scored High for confidentiality and integrity with no availability effect.
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.
Stored cross-site scripting in the HT Contact Form - Drag & Drop Form Builder for WordPress plugin (all versions up to and including 2.10.2) allows unauthenticated attackers to submit a crafted value through a form's Rich Text Editor field that is saved without adequate sanitization and rendered without adequate output escaping. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N scores 7.2, reflecting that injection needs neither authentication nor interaction, but execution is deferred and only occurs when a user - most significantly a logged-in administrator reviewing form submissions, or any visitor to the affected page - loads the poisoned content. Impact is therefore real but bounded: it depends on the Rich Text Editor field being present in a deployed, publicly reachable form and on someone subsequently viewing the stored payload. No public exploit identified at time of analysis, and the plugin author has published a fix changeset referenced by the Wordfence advisory.
PHP object injection in the ConvertPlus WordPress plugin (all versions through 3.6.3) allows any authenticated attacker at Subscriber level or above to reach the cp_display_preview_modal AJAX action, bypass its nonce guard simply by omitting the cp_admin_page_nonce parameter (the isset() check fails open and no capability check is performed), and inject a second attacker-controlled [smile_modal] shortcode via the style parameter that ultimately feeds attacker-supplied base64-decoded bytes into maybe_unserialize() with no allowed_classes restriction. The object-injection primitive is inert by itself - ConvertPlus ships no usable POP gadget chain - so real impact such as arbitrary file deletion, sensitive data disclosure, or code execution requires a separate installed plugin or theme that provides a compatible chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflects the low-privilege login requirement and the strong third-party gadget-chain dependency rather than automatic compromise.
Malcure Malware Shield (Removal, Repair, Monitor) before 19.9.7 fails to enforce an authorization check on an AJAX action, allowing an authenticated subsite administrator on a WordPress multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution. The vulnerability requires a multisite installation and an existing privileged account (CVSS PR:H); it is not exploitable on single-site installs or by unauthenticated users, and SSVC records Automatable:no. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV absent; SSVC Exploitation:none), and EPSS is low at 0.18% (7th percentile).
Stored cross-site scripting in the commercial Download Manager Pro WordPress plugin (before version 7.5.6) allows an unauthenticated attacker to inject script payloads through the plugin's email-locked download subscription form, which are then rendered unsanitized on an administrator-facing page and execute in the admin's browser session. The free plugin distributed under the same slug does not ship the affected feature and is not vulnerable, so only sites running the Pro edition with that subscription form in use are exposed - and exploitation only completes when an administrator subsequently views the poisoned admin page. Publicly available exploit code exists (WPScan published the vector), but there is no confirmed active exploitation (CISA KEV does not list it), SSVC records Exploitation: none and Automatable: no because of the mandatory admin interaction, and EPSS is low at 0.17% (6th percentile), which is why this is treated as a moderate-priority issue rather than the critical score implied by the vendor's 8.8 CVSS.
Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation in the WordPress plugin Groups - Memberships and Access Control (itthinx) affects all versions up to and including 4.6.0, allowing any authenticated Subscriber-level user to self-enroll in arbitrary groups - including privileged admin groups - and ultimately mint a group that grants every registered WordPress capability, reaching Administrator. The root cause is an authorization check in groups_join() that reads the ambient post's author capabilities ($post->post_author) instead of the acting user's, while the same response hands the caller a valid join hash and nonce; an attacker only needs valid low-privilege credentials and the post ID of any Administrator-authored post, supplied via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode AJAX handler, with no victim interaction. Per available intelligence there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though our independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, given the low bar of Subscriber self-registration on many sites.
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin (all versions up to and including 5.5.5) allows an unauthenticated remote attacker to log in as any existing administrator account by submitting only a known admin username, an empty password, and the POST parameter mo_wp_login_intent=otp - no password or OTP check is ever performed. Exploitation requires a specific, non-default configuration in which the site administrator has simultaneously enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass; that prerequisite stack is the primary limiting factor and is why our independent assessment rates the issue AC:H rather than the AC:L assumed by the published 9.8 score, while the impact ceiling (full WordPress site takeover via an administrator session) remains high. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so risk is real but contingent on the vulnerable option combination being present; the upstream plugin repository shows a code fix commit.
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Unauthenticated attackers can create or overwrite arbitrary WordPress posts through the Testimonials Widget plugin's front-end testimonial submission form in versions up to 4.0.4. The missing capability and ownership check (CWE-862) lets any anonymous visitor change post titles, content, and authors without authentication or user interaction, with impact limited to content integrity. Publicly available exploit code exists, but EPSS is low at 0.14% (3rd percentile), SSVC reports no observed exploitation, and CISA KEV does not list the issue.
Cross-site request forgery in the MCP Server for WordPress plugin (all versions before 1.8.2) allows unauthenticated attackers to perform administrator-only actions - including creating a brand-new administrator account - by tricking a logged-in WordPress administrator into visiting a crafted page. The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when an attacker-influenceable condition is present, so the victim's admin session is abused without any credential from the attacker (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-352). Publicly available exploit code exists per WPScan, but there is no confirmation of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is a low 0.10% (1st percentile); the practical gate is that a logged-in administrator must be lured to an attacker-controlled page while the vulnerable plugin is active.
Cross-site scripting in the WordPress File Manager plugin (below 8.0.5), FileOrganizer (below 1.2.1) and File Manager Pro (below 2.1.3) allows an unauthenticated attacker to run arbitrary JavaScript inside the session of a logged-in administrator, because the file browser these plugins embed accepts window.postMessage events from any origin that is merely a leading-string prefix of the victim site's own address. Exploitation requires the administrator to be logged in and to visit an attacker-controlled page on such a prefix origin (for example a domain whose name begins with the victim's hostname), which is reflected in the CVSS vector as UI:R with AC:H while PR:N confirms no attacker authentication is needed. Publicly available exploit code exists and the vendor has released fixes, but CISA SSVC rates exploitation as none and automatable as no, and EPSS is only 0.17% (6th percentile), so this is a conditional rather than a mass-exploitation risk.
Stored cross-site scripting in the WP Review Slider Pro WordPress plugin (versions before 12.7.12) allows any authenticated user, including a Subscriber, to overwrite a live review submission form with unescaped field values because the AJAX save handler performs no capability check and issues a nonce to every visitor. A victim who later views the compromised public form has the injected script executed in their browser (user interaction required), yielding low confidentiality and integrity impact as assessed by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists per WPScan, CISA's SSVC assessment records no observed exploitation, EPSS is only 0.16% (4th percentile), and a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to persist arbitrary markup into review content that is later rendered without output escaping on public pages, executing script in the browser of any visitor who views them. The root cause is a missing capability check on an AJAX handler combined with a nonce that is issued to every visitor and therefore provides no authorization boundary; the published CVSS vector is network-reachable with low privileges and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), and although the reporting source scored it 8.0, an independent assessment scores it considerably lower (S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session within the site origin. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.16% (4th percentile); a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who holds the plugin's listing-management role (and who does not have the WordPress unfiltered_html capability) inject script into a listing's category and location fields, which the plugin then prints unescaped inside page attributes; the payload persists and executes for any anonymous visitor who views the affected directory page, requiring no further interaction from the victim. The attacker must already possess that elevated listing-management role and the plugin must be installed with directory listings in active use, so this is a genuine but conditional issue rather than a public-facing injection path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile); the vendor has released a fix in 1.5.8.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; version 2.2.8 resolves the issue.
Remote code execution in the WordPress s2Member plugin (all versions up to and including 260814) lets unauthenticated attackers execute arbitrary PHP on the server by injecting code through the 'first_name' parameter, which is substituted unsanitized into an eval'd Signup Tracking Codes template. Exploitation is conditional rather than default-config: the site administrator must have configured a Signup Tracking Codes template containing the documented %%first_name%% placeholder, and the attacker must first obtain the site-global proxy verification key that s2Member exposes in plaintext in the JSON response of any PayPal Checkout AJAX request, which also permits bypassing PayPal postback verification. Both prerequisites together yield unauthenticated remote code execution with high attack complexity and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was provided.
Unauthenticated stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions up to and including 6.5.2) lets an attacker persist arbitrary JavaScript through the Shortcode Order elements[].title parameter. The payload is written to the DOM via innerHTML in the beforeElementAdd JavaScript event handler when a logged-in administrator opens and reviews the poisoned shortcode order in the WordPress admin panel, so injection is remote and unauthenticated (PR:N) but execution is gated on the admin review workflow and on the store actually using the shortcode order feature. There is no public exploit identified at time of analysis; the assessed vector (UI:R) is more restrictive than the published 7.2 High (UI:N), so the practical severity is lower than the raw score suggests.
Unauthenticated attackers can enumerate private and draft galleries and retrieve the original private image bytes from any WordPress site running the Modula Image Gallery - Photo Grid & Video Gallery plugin in versions up to and including 3.0.1. The plugin's Modula_Meta::add_metas() method is hooked to wp_head on every frontend request and builds Open Graph/Twitter meta tags from whatever post ID is supplied in the modula_gallery_id GET parameter, without verifying the gallery's post_status or the requester's read capability, so the response leaks the private gallery item's title, description, dimensions and original upload URL. Exploitation is remote and unauthenticated with no user interaction (CVSS 3.1 base 7.5, confidentiality-only impact), and gallery post IDs are sequential, making enumeration trivial; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. No public exploit code has been identified and no active exploitation has been confirmed - it is a genuine but moderate-priority issue that should be prioritized where public registration forms with the Avatar field are exposed.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin (versions up to and including 7.2.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the cart_items[][product_name] parameter, which is persisted and later executed in the browser of any logged-in user who views an affected invoice page. The plugin's checkout REST route is exposed without authentication (permission_callback set to __return_true) and its invoice loader performs no order ownership check, confirming remote unauthenticated exploitation against default configurations with no special conditions; impact is confined to client-side script execution in the viewer's session. No public exploit identified at time of analysis and no CISA KEV active-exploitation entry exists, though the CVSS 3.1 score is 7.2 High.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Stored cross-site scripting in the Zero Spam for WordPress plugin (all versions up to and including 5.7.10) lets unauthenticated attackers push arbitrary HTML or JavaScript into the plugin's spam log through its Contact Form 7 integration. The payload rides in a nested POST array key - PHP parses the crafted field name into a nested array key that is written verbatim to the zerospam_log.submission_data column whenever the submission is flagged as spam, and it executes when an administrator opens the flagged submission in the admin spam-log details modal, so exploitation depends on privileged user interaction despite unauthenticated injection. The base CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N per the CVE record, though our assessment adjusts UI to R for the required admin view); no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Stored cross-site scripting in the BA Book Everything WordPress plugin affects every version up to and including 1.8.27: the first_name field submitted through the public [babe-booking-form] booking flow is neither sanitized on input nor escaped on output, so a payload persists and executes in the browser of any user who later views the affected order or payment page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) indicates the injection step requires no authentication - an attacker can create a guest booking through the shortcode, harvest the returned order_id, order_num and order_hash, and then reach the action_to_pay() handler with a malicious first_name value. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is bounded by the plugin being installed and active at <=1.8.27, the booking shortcode being published on a reachable page, and a victim (typically an administrator or staff member reviewing orders) actually opening the injected page.
Stored DOM-based cross-site scripting in HT Contact Form - Drag & Drop Form Builder for WordPress (all versions up to and including 2.10.1) allows unauthenticated attackers to inject arbitrary JavaScript through the 'form_data' Rich Text Field, which then executes in a victim's browser. Injection occurs because the plugin's draft save/resume flow neither sanitizes the rich-text input nor escapes it on output, and the save response hands back the draft_key and access_token needed to build a resume URL. Exploitation is not automatic: an attacker must socially engineer a victim into clicking the crafted draft-resume link, which is why the independently assessed vector scores user interaction as required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 7.2) even though Wordfence's published vector lists UI:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no availability or server-side code-execution impact.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logos and documents - is possible in the Customer Reviews for WooCommerce plugin through version 5.120.0, because a missing authorization check (CWE-862) in the review-submission handler lets an unauthenticated remote attacker inject arbitrary attachment IDs into a review that is later trashed and purged through the normal moderation lifecycle. Exploitation depends on a live public review-form link (a 13-hex formId that the store distributes to customers by e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session, and the impact is integrity/availability only - there is no confidentiality impact (C:N). Wordfence rates this CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin, versions up to and including 6.5.2, lets unauthenticated attackers inject arbitrary web scripts through the output_format parameter when the Pro Export/Genius feature is enabled. The injected payload is stored and executes when any user, including an administrator, later views the affected page; the CVSS 3.1 base score is 7.2, and no public exploit was identified at time of analysis. Sites without the non-default Pro Export/Genius feature enabled are not exposed because the vulnerable fpd_pr_export AJAX action is not registered.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions through 6.5.2) lets unauthenticated attackers inject arbitrary JavaScript into order item metadata, which executes in an administrator's browser when the affected order is opened in wp-admin. The injection route is the plugin's fpd_save_order AJAX action, registered for logged-out users via wp_ajax_nopriv_fpd_save_order with no nonce and no capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences that json_decode() converts back into literal angle brackets at render time. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), meaning remote and unauthenticated at injection time with a scope change because the payload executes in the privileged admin context; the provided intelligence contains no KEV entry, and no public exploit code was identified at time of analysis. Practical impact is bounded by the fact that the payload only fires when a store administrator or shop manager views the affected order, so it is a client-side XSS in the admin browser rather than server compromise or remote code execution.
Stored cross-site scripting in the AMP for WP - Accelerated Mobile Pages WordPress plugin, affecting all versions up to and including 1.1.16, allows unauthenticated attackers to submit comment content that is transformed by a regex routine into an anchor carrying a javascript: URI, which the plugin's AMP sanitizer does not strip. The injected script persists in the database and executes in the browser of any visitor who loads the AMP-rendered version of the affected page, giving a scope-changed (S:C) impact rated CVSS 7.2 with PR:N (no authentication required), though realized exploitation depends on victims actually browsing the AMP output rather than the canonical page. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.
Unauthenticated local file inclusion in the Visual Composer Website Builder plugin for WordPress (all versions up to and including 45.16.0) lets remote attackers supply the vcv-template request parameter to force the server to include and execute files of their choosing. Because the vulnerable code path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), attackers can directly bypass access controls and read sensitive files on the host; full PHP code execution is achievable only where the attacker can also plant an includable file (for example an uploaded image or other supposedly 'safe' file type) on the server. At time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, though the Wordfence advisory and the plugin's own Trac changeset confirm an upstream fix has been committed.
Account takeover of WordPress sites running YOP Poll 7.0.10 or earlier is possible because the plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin, allowing any origin to capture the Administrator-scoped nonce. An unauthenticated attacker can then use the stolen nonce to change the Administrator's email address and password, but exploitation requires the logged-in Administrator to open an attacker-controlled page (UI:R) while the vulnerable plugin is active. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated path traversal in the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin lets any remote attacker read arbitrary files from the host server on any site running version 1.0.3 or earlier. The flaw is reached through the id2wp_path parameter and requires no authentication, no privileges, and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 7.5 HIGH), with impact limited to confidentiality because the attacker can only retrieve files the web server process itself is permitted to read. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; the practical risk is opportunistic scanning of WordPress sites that have this niche plugin installed and active.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
Unauthenticated privilege escalation in the Paytium: Mollie payment forms & donations WordPress plugin (all versions up to and including 5.0.3) allows an attacker to create a brand-new WordPress user with the administrator role and take over the site. The flaw lives in the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook, which copies attacker-supplied $_POST['pt_form_field'] keys, including pt-user-role, straight into payment meta and ultimately into wp_insert_user(); exploitation requires a publicly reachable [paytium] shortcode form and completion of an actual Mollie payment so the malicious role meta is persisted, after which the attacker claims the new admin account via the standard lost-password flow. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), though the vendor-published Wordfence advisory and the 9.8 CVSS rating (AV:N/AC:L/PR:N/UI:N) make this a high-priority unauthenticated issue for any site running the affected versions with a public Paytium form.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
An authentication bypass in the EthPress - Web3 Login WordPress plugin, affecting all versions up to and including 2.3.5, allows unauthenticated remote attackers to log in as any WordPress user with a linked Ethereum wallet address - including administrators - simply by supplying that user's public wallet address together with an arbitrary, well-formed (but invalid) signature, resulting in full site takeover. The root cause is a missing return statement in verify_login() that lets execution fall through to the cookie-setting login routine even when signature verification fails; no public exploit code has been identified at time of analysis, and the assessment rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the 'high' attack complexity reflecting the need to discover a valid linked wallet address rather than any authentication barrier. Because exploitation is unauthenticated and requires no user interaction, any site where at least one account (especially an administrator) has linked a wallet should be treated as exposed until patched or the plugin is disabled.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated SQL injection in the WordPress/WooCommerce plugin Product Filter by WBW (versions 3.1.7 and earlier) lets any remote visitor inject SQL through the plugin's public-facing product-filter functionality and read arbitrary data from the site's database, with no login and no victim interaction required. The reporting source (Patchstack) and ENISA EUVD both classify this as a high-severity SQLi, while the assessed vector constrains the impact to confidentiality only (C:H/I:N/A:N) rather than the scope-change-plus-availability model that produces the 9.3 headline score, so the practical effect is large-scale data disclosure rather than remote code execution or denial of service. No public exploit code has been identified and there is no evidence of active exploitation at time of analysis; exploitation depends solely on whether the affected plugin is installed, active, and reachable on a standard WordPress deployment.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
Reflected cross-site scripting (XSS) in the Ninja Forms WordPress plugin through version 3.15.3 allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser when the victim is tricked into loading a crafted link (UI:R). Reported by Patchstack, no public exploit identified at time of analysis, and the assessed impact is limited to client-side script execution within the site origin due to required user interaction and no server-side code execution. The CVE record assigns a CVSS score of 7.1, but our independent assessment notes no availability impact (A:N) and characterizes the issue as moderate severity.
Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated remote code execution in the AcyMailing SMTP Newsletter WordPress plugin (versions 11.0.5 and earlier) allows a remote attacker to execute arbitrary code on the underlying server, leading to full site compromise. The CVSS 3.1 base score is 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating no authentication or user interaction is required, though the high attack complexity (AC:H) signals that reliable exploitation likely depends on a specific precondition, application state, or configuration that the attacker must arrange or wait for. No public exploit code is currently identified, and the vulnerability is not listed in CISA KEV.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (Javier Carazo) at versions up to and including 2.5.2 lets an authenticated low-privileged account - specifically a Subscriber - reach higher-privileged roles, giving full compromise of the site's confidentiality, integrity, and availability (CVSS 3.1 base 7.5, High). The advisory-supplied vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attack is network-reachable and needs no victim interaction, but the High Attack Complexity rating reflects a non-trivial precondition (a specific plugin state, ordering, or crafted import payload) that limits how reliably it can be pulled off; it does require the attacker to already hold a Subscriber account, which is trivial on sites with open registration enabled. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as a targeted-risk rather than a mass-scanning risk; no EPSS probability was supplied with this record.
SQL injection in GamiPress WordPress plugin versions 8.0.2 and earlier allows unauthenticated attackers to read sensitive data from the database. Our independent assessment indicates no user interaction or authentication is required (PR:N), though the originally provided CVSS vector specifies PR:L, creating a discrepancy that should be verified with the vendor. No public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
PHP object injection in the Responsive Slider Gallery WordPress plugin (versions up to and including 1.5.5) lets an authenticated Editor-level user pass crafted serialized data into an unsafe unserialize() call, potentially triggering arbitrary object instantiation and, given a usable POP gadget chain, file manipulation or remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) confirms network reachability and full confidentiality, integrity, and availability impact, but the high-privilege prerequisite excludes anonymous or subscriber-level attackers. No public exploit code has been identified at time of analysis and the vulnerability is not reported as actively exploited (no CISA KEV entry); the plugin's limited deployment footprint further narrows the exposed population.
PHP object injection in the 10Web Booster WordPress plugin (versions up to 2.33.6) allows an authenticated Contributor to inject a malicious PHP object, potentially leading to remote code execution if a suitable gadget chain is present. The vulnerability is network-exploitable, requires no user interaction, and has a CVSS score of 8.8, but exploitation depends on the availability of a POP chain within the plugin or other installed components. No public exploit code has been identified at time of analysis.
GravityExport Lite for Gravity Forms versions up to and including 2.7.2 contains a broken access control vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass authorization and access sensitive export data, resulting in high confidentiality impact. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a low-complexity, network-exploitable flaw with no integrity or availability impact. Exploitation requires the plugin to be installed on a site with Gravity Forms, but no authentication or user interaction is needed; no public exploit code is currently identified.
Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim loads a page rendering the malicious content, with CVSS 3.1 scoring it 7.1 High due largely to scope change and unauthenticated reach. Exploitation requires user interaction (UI:R) and is most realistic on sites that accept untrusted or public review submissions or otherwise render attacker-controlled input to a privileged viewer, and there is no public exploit identified at time of analysis. Impact is limited to the browser context, such as session or credential theft and action forgery, rather than direct server compromise.
PHP object injection in the WordPress plugin SEO Plugin by Squirrly SEO (through version 14.2.5) allows an authenticated attacker with only Contributor-level access to feed crafted serialized data into PHP's unserialize(), which can escalate to remote code execution, arbitrary file operations, or SQL injection if a usable POP gadget chain is reachable in the plugin, WordPress core, or another installed plugin. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is a genuine high-priority issue, but the practical blast radius depends on two prerequisites: the site must permit untrusted or self-registered Contributor accounts, and a viable gadget chain must exist. No public exploit code has been identified at time of analysis and the vulnerability is not known to be actively exploited (not in CISA KEV); it is not exploitable by fully unauthenticated visitors.
PHP object injection in Cost of Goods for WooCommerce versions up to 3.5.2 allows an authenticated attacker with the WooCommerce Shop Manager role to submit crafted data that is unsafely deserialized, potentially achieving full confidentiality, integrity, and availability impact. The issue is rated CVSS 7.2 (High) and requires PR:H, so exploitation is limited to trusted staff or attackers who already control a Shop Manager account; no public exploit code or CISA KEV entry is present in the provided data. Successful exploitation further depends on a reachable POP gadget chain in the plugin, WooCommerce, WordPress core, or another installed plugin.
Cross-site scripting (XSS) in the WP Statistics WordPress plugin (versions 14.16.13 and earlier) enables remote, unauthenticated attackers to inject malicious scripts into web pages. Exploitation requires a victim to interact with a crafted link or page, after which the script executes in the victim's browser context, potentially leading to session hijacking or data theft. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Minimum and Maximum Quantity for WooCommerce plugin (versions up to and including 2.1.2) lets an authenticated user holding Author-level privileges or higher feed attacker-controlled serialized data into an unsafe PHP deserialization path on WordPress sites that also run WooCommerce. Per the assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), impact is rated full across confidentiality, integrity and availability, but the high-privilege prerequisite (PR:H) excludes anonymous visitors and typical subscriber/customer accounts, and meaningful impact additionally depends on a usable PHP object-injection gadget chain being present in the plugin, WooCommerce, or WordPress core. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
Unauthenticated cross-site scripting in the WordPress plugin Notification for Telegram (versions up to and including 3.5.2) lets a remote attacker inject script that executes in a victim's browser when the crafted content is rendered. No authentication is required to deliver the payload (PR:N), but exploitation depends on a logged-in or administrative user visiting the page where the injected script is displayed (UI:R), and the resulting impact is limited to the client side with low confidentiality, integrity, and availability effects under a scope change (S:C). No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); EPSS data was not provided, so no exploitation-probability figure is asserted here.
Unauthenticated cross-site scripting in JW Player for WordPress 2.3.11 and earlier allows remote attackers to inject script into a victim's browser when the victim interacts with a crafted link or attacker-influenced page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) reflects a network-reachable, low-complexity flaw that requires no attacker authentication but does require user interaction; successful exploitation runs script in the victim site's origin due to scope change. The issue is reported via Patchstack, and no public exploit or CISA KEV active-exploitation confirmation was provided at time of analysis.
SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. The supplied base CVSS is 7.6, and the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, while the provided NVD-style vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L.
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they are tricked into clicking a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring user interaction but no authentication, with a scope change and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Authentication bypass in the GiveWP WordPress donation plugin (all versions through 4.16.9) allows remote, unauthenticated attackers to satisfy the plugin's credential/equivalence check with crafted input and reach privileged plugin functionality on any affected site. Scoring CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires only that the plugin be installed and reachable - no account, no privileges, and no victim interaction - with high confidentiality and integrity impact, which makes automated scanning of WordPress installs a realistic attack model. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the severity and trivial preconditions rather than observed exploitation.
Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Stored cross-site scripting in the Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 lets unauthenticated attackers upload a file whose contents are never validated and which the plugin then serves back with an attacker-controlled content type, so the embedded JavaScript executes in the browser of any user who opens the uploaded file's URL. Exploitation requires the target site to expose the plugin's file storage/upload feature and depends on a victim opening the attacker-supplied file link (UI:R), so it is not an automatic drive-by compromise; no public exploit code was identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none'. Sites running version 4.13.1 or later are not affected, and the vendor has released a fix.
Stored cross-site scripting in the WP Mobile Menu WordPress plugin (versions 2.7.4 up to but not including 2.9) lets an attacker import arbitrary plugin settings through a forged cross-site request in a logged-in administrator's session, because the settings-import routine does not correctly verify its nonce. The imported values are then rendered unescaped to every site visitor, so the injected script persists and executes for all users until the malicious setting is removed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the attacker needs no account of their own but must socially engineer a privileged, authenticated admin into loading the crafted request; there is no public exploit code identified at time of analysis, exploitation has not been observed, and patch status is vendor-released version 2.9.
Stored cross-site scripting in the Robin Image Optimizer WordPress plugin (versions 2.0.0 up to but not including 2.0.8) lets unauthenticated users submit content that is persisted and later rendered as script in the browser of anyone viewing the affected page, including administrators. The flaw is conditional: the bundled HTML parser only re-emits unescaped values into element attributes when the plugin's non-default image delivery mode is enabled, so installations running the default mode are not exposed. Vendor-released patch: 2.0.8; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none and the issue as not automatable, making this a real but situational stored-XSS risk rather than an emergency.
Authenticated plugin installation in the Vayu X WordPress theme before 1.0.6 allows any logged-in user - even a Subscriber - to install and activate arbitrary plugins hosted on the WordPress.org repository. The theme's AJAX action omits a capability check (CWE-284) and leaks its guarding nonce to every authenticated user, so the nonce provides no protection whatsoever; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) reflects high integrity impact with no user interaction required. Exploitation is limited to WordPress.org-hosted plugins rather than arbitrary code upload, so maximum impact depends on chaining to a vulnerable installable plugin; no public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and CISA SSVC rates exploitation as none and automatable as no.
Stored cross-site scripting in the WordPress plugin All in One Files Upload (versions 2.0.3 through 2.0.16) lets unauthenticated visitors upload SVG files containing active content that executes in the site's origin when a victim opens or previews the file, potentially handing an attacker administrator-level control of the site if a privileged user is the one who opens it. Exploitation requires no authentication (CVSS vector PR:N) and no non-default configuration, since the plugin itself whitelists SVG uploads and fails to verify the authenticity of its public upload requests, but it does require victim interaction (UI:R) and is assessed as not automatable per SSVC. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, though independent scoring disagrees with the vendor-side 8.8 rating: our assessment scores scope change with limited confidentiality and integrity impact (S:C/C:L/I:L/A:N) because the realized impact depends entirely on a privileged victim opening the stored file, which is why the urgency signals conflict.
Unauthenticated arbitrary file upload in the Zella WordPress theme before version 2.6.3 lets remote attackers write arbitrary files - including PHP - into the site by abusing a font upload action that performs no capability or nonce check, yielding full remote code execution with a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every WordPress installation running this theme at a version below 2.6.3 in its default configuration is exposed; no login, user interaction, or non-default setting is required. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but CISA's SSVC assessment flags the flaw as fully automatable with total technical impact, so rapid weaponization should be assumed. The vendor has released a fix in version 2.6.3.
Privilege escalation in the WP User Frontend WordPress plugin before 4.3.12 lets unauthenticated visitors tamper with the role value submitted by the plugin's front-end registration form and create an account with elevated privileges such as Editor (the administrator role cannot be obtained this way). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms unauthenticated remote exploitation with no user interaction, but the AC:H reflects a narrow environmental precondition: the site must run on a PHP build where the sodium (libsodium) extension is unavailable, and a public registration page must be configured through the plugin. No public exploit code has been identified at time of analysis, and the SSVC assessment records Exploitation: none; impact is scored High for confidentiality and integrity with no availability effect.
Stored DOM-based cross-site scripting in FPSM Lite through 1.3.4 lets unauthenticated attackers inject arbitrary scripts via the post_content parameter when the site has enabled guest post submission through the [fpsm] shortcode. The flaw is rooted in insufficient input sanitization and output escaping reaching a client-side data-label DOM sink, so the injected script executes when a victim views the affected page. No public exploit code has been identified, but exploitation is conditional on the shortcode-driven guest submission path being active; upgrading to 1.3.5 fixes the issue.
Stored cross-site scripting in the HT Contact Form - Drag & Drop Form Builder for WordPress plugin (all versions up to and including 2.10.2) allows unauthenticated attackers to submit a crafted value through a form's Rich Text Editor field that is saved without adequate sanitization and rendered without adequate output escaping. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N scores 7.2, reflecting that injection needs neither authentication nor interaction, but execution is deferred and only occurs when a user - most significantly a logged-in administrator reviewing form submissions, or any visitor to the affected page - loads the poisoned content. Impact is therefore real but bounded: it depends on the Rich Text Editor field being present in a deployed, publicly reachable form and on someone subsequently viewing the stored payload. No public exploit identified at time of analysis, and the plugin author has published a fix changeset referenced by the Wordfence advisory.
PHP object injection in the ConvertPlus WordPress plugin (all versions through 3.6.3) allows any authenticated attacker at Subscriber level or above to reach the cp_display_preview_modal AJAX action, bypass its nonce guard simply by omitting the cp_admin_page_nonce parameter (the isset() check fails open and no capability check is performed), and inject a second attacker-controlled [smile_modal] shortcode via the style parameter that ultimately feeds attacker-supplied base64-decoded bytes into maybe_unserialize() with no allowed_classes restriction. The object-injection primitive is inert by itself - ConvertPlus ships no usable POP gadget chain - so real impact such as arbitrary file deletion, sensitive data disclosure, or code execution requires a separate installed plugin or theme that provides a compatible chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflects the low-privilege login requirement and the strong third-party gadget-chain dependency rather than automatic compromise.
Malcure Malware Shield (Removal, Repair, Monitor) before 19.9.7 fails to enforce an authorization check on an AJAX action, allowing an authenticated subsite administrator on a WordPress multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution. The vulnerability requires a multisite installation and an existing privileged account (CVSS PR:H); it is not exploitable on single-site installs or by unauthenticated users, and SSVC records Automatable:no. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV absent; SSVC Exploitation:none), and EPSS is low at 0.18% (7th percentile).
Stored cross-site scripting in the commercial Download Manager Pro WordPress plugin (before version 7.5.6) allows an unauthenticated attacker to inject script payloads through the plugin's email-locked download subscription form, which are then rendered unsanitized on an administrator-facing page and execute in the admin's browser session. The free plugin distributed under the same slug does not ship the affected feature and is not vulnerable, so only sites running the Pro edition with that subscription form in use are exposed - and exploitation only completes when an administrator subsequently views the poisoned admin page. Publicly available exploit code exists (WPScan published the vector), but there is no confirmed active exploitation (CISA KEV does not list it), SSVC records Exploitation: none and Automatable: no because of the mandatory admin interaction, and EPSS is low at 0.17% (6th percentile), which is why this is treated as a moderate-priority issue rather than the critical score implied by the vendor's 8.8 CVSS.
Stored code injection in the Ad Inserter WordPress plugin before 2.8.19 allows an authenticated user with a role as low as subscriber to save content that the plugin then executes as PHP or serves unescaped to site visitors, because one of the plugin's settings pages is not access-restricted and the data written there is not filtered. Exploitation is conditional rather than trivial: the threat actor needs a low-privileged account (easy on sites with open registration) and the site must be running a configuration in which the plugin's own settings make that page reachable by every logged-in user, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with total technical impact. Publicly available exploit code exists, but the EPSS score is only 0.15% (4th percentile), there is no CISA KEV listing, and independent review characterises this as a real-but-conditional priority rather than an emergency.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation in the WordPress plugin Groups - Memberships and Access Control (itthinx) affects all versions up to and including 4.6.0, allowing any authenticated Subscriber-level user to self-enroll in arbitrary groups - including privileged admin groups - and ultimately mint a group that grants every registered WordPress capability, reaching Administrator. The root cause is an authorization check in groups_join() that reads the ambient post's author capabilities ($post->post_author) instead of the acting user's, while the same response hands the caller a valid join hash and nonce; an attacker only needs valid low-privilege credentials and the post ID of any Administrator-authored post, supplied via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode AJAX handler, with no victim interaction. Per available intelligence there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though our independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, given the low bar of Subscriber self-registration on many sites.
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin (all versions up to and including 5.5.5) allows an unauthenticated remote attacker to log in as any existing administrator account by submitting only a known admin username, an empty password, and the POST parameter mo_wp_login_intent=otp - no password or OTP check is ever performed. Exploitation requires a specific, non-default configuration in which the site administrator has simultaneously enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass; that prerequisite stack is the primary limiting factor and is why our independent assessment rates the issue AC:H rather than the AC:L assumed by the published 9.8 score, while the impact ceiling (full WordPress site takeover via an administrator session) remains high. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so risk is real but contingent on the vulnerable option combination being present; the upstream plugin repository shows a code fix commit.
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Unauthenticated attackers can create or overwrite arbitrary WordPress posts through the Testimonials Widget plugin's front-end testimonial submission form in versions up to 4.0.4. The missing capability and ownership check (CWE-862) lets any anonymous visitor change post titles, content, and authors without authentication or user interaction, with impact limited to content integrity. Publicly available exploit code exists, but EPSS is low at 0.14% (3rd percentile), SSVC reports no observed exploitation, and CISA KEV does not list the issue.
Cross-site request forgery in the MCP Server for WordPress plugin (all versions before 1.8.2) allows unauthenticated attackers to perform administrator-only actions - including creating a brand-new administrator account - by tricking a logged-in WordPress administrator into visiting a crafted page. The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when an attacker-influenceable condition is present, so the victim's admin session is abused without any credential from the attacker (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-352). Publicly available exploit code exists per WPScan, but there is no confirmation of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is a low 0.10% (1st percentile); the practical gate is that a logged-in administrator must be lured to an attacker-controlled page while the vulnerable plugin is active.
Cross-site scripting in the WordPress File Manager plugin (below 8.0.5), FileOrganizer (below 1.2.1) and File Manager Pro (below 2.1.3) allows an unauthenticated attacker to run arbitrary JavaScript inside the session of a logged-in administrator, because the file browser these plugins embed accepts window.postMessage events from any origin that is merely a leading-string prefix of the victim site's own address. Exploitation requires the administrator to be logged in and to visit an attacker-controlled page on such a prefix origin (for example a domain whose name begins with the victim's hostname), which is reflected in the CVSS vector as UI:R with AC:H while PR:N confirms no attacker authentication is needed. Publicly available exploit code exists and the vendor has released fixes, but CISA SSVC rates exploitation as none and automatable as no, and EPSS is only 0.17% (6th percentile), so this is a conditional rather than a mass-exploitation risk.
Stored cross-site scripting in the WP Review Slider Pro WordPress plugin (versions before 12.7.12) allows any authenticated user, including a Subscriber, to overwrite a live review submission form with unescaped field values because the AJAX save handler performs no capability check and issues a nonce to every visitor. A victim who later views the compromised public form has the injected script executed in their browser (user interaction required), yielding low confidentiality and integrity impact as assessed by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists per WPScan, CISA's SSVC assessment records no observed exploitation, EPSS is only 0.16% (4th percentile), and a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to persist arbitrary markup into review content that is later rendered without output escaping on public pages, executing script in the browser of any visitor who views them. The root cause is a missing capability check on an AJAX handler combined with a nonce that is issued to every visitor and therefore provides no authorization boundary; the published CVSS vector is network-reachable with low privileges and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), and although the reporting source scored it 8.0, an independent assessment scores it considerably lower (S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session within the site origin. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.16% (4th percentile); a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who holds the plugin's listing-management role (and who does not have the WordPress unfiltered_html capability) inject script into a listing's category and location fields, which the plugin then prints unescaped inside page attributes; the payload persists and executes for any anonymous visitor who views the affected directory page, requiring no further interaction from the victim. The attacker must already possess that elevated listing-management role and the plugin must be installed with directory listings in active use, so this is a genuine but conditional issue rather than a public-facing injection path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile); the vendor has released a fix in 1.5.8.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Privilege escalation in the Knit Pay WordPress plugin through 9.6.1.0 lets an authenticated attacker with Subscriber-level access and above promote their own account to administrator by tampering with the hidden role field of a Gravity Forms submission. The flaw requires the plugin's Gravity Forms integration to be active and a feed configured so that user_role_field_id points at a form field; the plugin then passes that attacker-controlled value directly to WP_User::set_role() with no allowlist validation, and the process is further helped by $0 orders being marked SUCCESS synchronously at submission and by the role-assignment fallback to $lead['created_by'], the submitter's own user ID. At time of analysis no public exploit code or CISA KEV entry was identified, but with CVSS 8.8 and an authenticated low-privilege prerequisite, this is a high-priority issue for any site running the vulnerable plugin together with a configured Gravity Forms feed.
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; version 2.2.8 resolves the issue.
Remote code execution in the WordPress s2Member plugin (all versions up to and including 260814) lets unauthenticated attackers execute arbitrary PHP on the server by injecting code through the 'first_name' parameter, which is substituted unsanitized into an eval'd Signup Tracking Codes template. Exploitation is conditional rather than default-config: the site administrator must have configured a Signup Tracking Codes template containing the documented %%first_name%% placeholder, and the attacker must first obtain the site-global proxy verification key that s2Member exposes in plaintext in the JSON response of any PayPal Checkout AJAX request, which also permits bypassing PayPal postback verification. Both prerequisites together yield unauthenticated remote code execution with high attack complexity and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was provided.
Unauthenticated stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions up to and including 6.5.2) lets an attacker persist arbitrary JavaScript through the Shortcode Order elements[].title parameter. The payload is written to the DOM via innerHTML in the beforeElementAdd JavaScript event handler when a logged-in administrator opens and reviews the poisoned shortcode order in the WordPress admin panel, so injection is remote and unauthenticated (PR:N) but execution is gated on the admin review workflow and on the store actually using the shortcode order feature. There is no public exploit identified at time of analysis; the assessed vector (UI:R) is more restrictive than the published 7.2 High (UI:N), so the practical severity is lower than the raw score suggests.
Unauthenticated attackers can enumerate private and draft galleries and retrieve the original private image bytes from any WordPress site running the Modula Image Gallery - Photo Grid & Video Gallery plugin in versions up to and including 3.0.1. The plugin's Modula_Meta::add_metas() method is hooked to wp_head on every frontend request and builds Open Graph/Twitter meta tags from whatever post ID is supplied in the modula_gallery_id GET parameter, without verifying the gallery's post_status or the requester's read capability, so the response leaks the private gallery item's title, description, dimensions and original upload URL. Exploitation is remote and unauthenticated with no user interaction (CVSS 3.1 base 7.5, confidentiality-only impact), and gallery post IDs are sequential, making enumeration trivial; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. No public exploit code has been identified and no active exploitation has been confirmed - it is a genuine but moderate-priority issue that should be prioritized where public registration forms with the Avatar field are exposed.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin (versions up to and including 7.2.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the cart_items[][product_name] parameter, which is persisted and later executed in the browser of any logged-in user who views an affected invoice page. The plugin's checkout REST route is exposed without authentication (permission_callback set to __return_true) and its invoice loader performs no order ownership check, confirming remote unauthenticated exploitation against default configurations with no special conditions; impact is confined to client-side script execution in the viewer's session. No public exploit identified at time of analysis and no CISA KEV active-exploitation entry exists, though the CVSS 3.1 score is 7.2 High.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Stored cross-site scripting in the Zero Spam for WordPress plugin (all versions up to and including 5.7.10) lets unauthenticated attackers push arbitrary HTML or JavaScript into the plugin's spam log through its Contact Form 7 integration. The payload rides in a nested POST array key - PHP parses the crafted field name into a nested array key that is written verbatim to the zerospam_log.submission_data column whenever the submission is flagged as spam, and it executes when an administrator opens the flagged submission in the admin spam-log details modal, so exploitation depends on privileged user interaction despite unauthenticated injection. The base CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N per the CVE record, though our assessment adjusts UI to R for the required admin view); no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Stored cross-site scripting in the BA Book Everything WordPress plugin affects every version up to and including 1.8.27: the first_name field submitted through the public [babe-booking-form] booking flow is neither sanitized on input nor escaped on output, so a payload persists and executes in the browser of any user who later views the affected order or payment page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) indicates the injection step requires no authentication - an attacker can create a guest booking through the shortcode, harvest the returned order_id, order_num and order_hash, and then reach the action_to_pay() handler with a malicious first_name value. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is bounded by the plugin being installed and active at <=1.8.27, the booking shortcode being published on a reachable page, and a victim (typically an administrator or staff member reviewing orders) actually opening the injected page.
Stored DOM-based cross-site scripting in HT Contact Form - Drag & Drop Form Builder for WordPress (all versions up to and including 2.10.1) allows unauthenticated attackers to inject arbitrary JavaScript through the 'form_data' Rich Text Field, which then executes in a victim's browser. Injection occurs because the plugin's draft save/resume flow neither sanitizes the rich-text input nor escapes it on output, and the save response hands back the draft_key and access_token needed to build a resume URL. Exploitation is not automatic: an attacker must socially engineer a victim into clicking the crafted draft-resume link, which is why the independently assessed vector scores user interaction as required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 7.2) even though Wordfence's published vector lists UI:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no availability or server-side code-execution impact.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logos and documents - is possible in the Customer Reviews for WooCommerce plugin through version 5.120.0, because a missing authorization check (CWE-862) in the review-submission handler lets an unauthenticated remote attacker inject arbitrary attachment IDs into a review that is later trashed and purged through the normal moderation lifecycle. Exploitation depends on a live public review-form link (a 13-hex formId that the store distributes to customers by e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session, and the impact is integrity/availability only - there is no confidentiality impact (C:N). Wordfence rates this CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin, versions up to and including 6.5.2, lets unauthenticated attackers inject arbitrary web scripts through the output_format parameter when the Pro Export/Genius feature is enabled. The injected payload is stored and executes when any user, including an administrator, later views the affected page; the CVSS 3.1 base score is 7.2, and no public exploit was identified at time of analysis. Sites without the non-default Pro Export/Genius feature enabled are not exposed because the vulnerable fpd_pr_export AJAX action is not registered.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions through 6.5.2) lets unauthenticated attackers inject arbitrary JavaScript into order item metadata, which executes in an administrator's browser when the affected order is opened in wp-admin. The injection route is the plugin's fpd_save_order AJAX action, registered for logged-out users via wp_ajax_nopriv_fpd_save_order with no nonce and no capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences that json_decode() converts back into literal angle brackets at render time. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), meaning remote and unauthenticated at injection time with a scope change because the payload executes in the privileged admin context; the provided intelligence contains no KEV entry, and no public exploit code was identified at time of analysis. Practical impact is bounded by the fact that the payload only fires when a store administrator or shop manager views the affected order, so it is a client-side XSS in the admin browser rather than server compromise or remote code execution.
Stored cross-site scripting in the AMP for WP - Accelerated Mobile Pages WordPress plugin, affecting all versions up to and including 1.1.16, allows unauthenticated attackers to submit comment content that is transformed by a regex routine into an anchor carrying a javascript: URI, which the plugin's AMP sanitizer does not strip. The injected script persists in the database and executes in the browser of any visitor who loads the AMP-rendered version of the affected page, giving a scope-changed (S:C) impact rated CVSS 7.2 with PR:N (no authentication required), though realized exploitation depends on victims actually browsing the AMP output rather than the canonical page. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site request forgery in Elementor Website Builder (all versions through 4.3.1) lets a remote attacker who holds no credentials of their own induce a logged-in WordPress administrator into silently executing unintended state-changing actions inside the victim's authenticated session. Exploitation requires both a privileged user to be authenticated and that user to be lured onto attacker-controlled content (CVSS UI:R), which caps practical severity despite the high base score of 8.8 reported by the researcher; our independent assessment scores the same vector at C:L/I:L/A:N because the achievable action set is not fully characterised in the advisory. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score or client-side patch detail was supplied in the source data.
Unauthenticated local file inclusion in the Visual Composer Website Builder plugin for WordPress (all versions up to and including 45.16.0) lets remote attackers supply the vcv-template request parameter to force the server to include and execute files of their choosing. Because the vulnerable code path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), attackers can directly bypass access controls and read sensitive files on the host; full PHP code execution is achievable only where the attacker can also plant an includable file (for example an uploaded image or other supposedly 'safe' file type) on the server. At time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, though the Wordfence advisory and the plugin's own Trac changeset confirm an upstream fix has been committed.
Account takeover of WordPress sites running YOP Poll 7.0.10 or earlier is possible because the plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin, allowing any origin to capture the Administrator-scoped nonce. An unauthenticated attacker can then use the stolen nonce to change the Administrator's email address and password, but exploitation requires the logged-in Administrator to open an attacker-controlled page (UI:R) while the vulnerable plugin is active. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated path traversal in the eesy_ID2WP - Publish InDesign HTML5 WordPress plugin lets any remote attacker read arbitrary files from the host server on any site running version 1.0.3 or earlier. The flaw is reached through the id2wp_path parameter and requires no authentication, no privileges, and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 7.5 HIGH), with impact limited to confidentiality because the attacker can only retrieve files the web server process itself is permitted to read. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; the practical risk is opportunistic scanning of WordPress sites that have this niche plugin installed and active.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
Unauthenticated privilege escalation in the Paytium: Mollie payment forms & donations WordPress plugin (all versions up to and including 5.0.3) allows an attacker to create a brand-new WordPress user with the administrator role and take over the site. The flaw lives in the unsigned pt_cf_checkout_meta() filter on the pt_meta_values hook, which copies attacker-supplied $_POST['pt_form_field'] keys, including pt-user-role, straight into payment meta and ultimately into wp_insert_user(); exploitation requires a publicly reachable [paytium] shortcode form and completion of an actual Mollie payment so the malicious role meta is persisted, after which the attacker claims the new admin account via the standard lost-password flow. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), though the vendor-published Wordfence advisory and the 9.8 CVSS rating (AV:N/AC:L/PR:N/UI:N) make this a high-priority unauthenticated issue for any site running the affected versions with a public Paytium form.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions up to and including 2.4.17) allows any authenticated user at Subscriber level or above to become an Administrator. The attacker stores crafted values in their own display_name and nickname profile fields and then waits for a site administrator to run the plugin's documented export-then-reimport migration with both 'Update existing users' and 'Update roles for existing users' set to 'yes'; a CSV quoting/escape mismatch between exporter and importer causes the crafted display_name to be consumed as the role field, yielding 'administrator' at the importer's add_role call. Exploitation is not self-contained - it requires the operator to enable those two non-default migration settings - and no public exploit identified at time of analysis. The vendor risk score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment re-rates it as AV:N/AC:H/PR:L/UI:R because the admin-driven, non-default migration workflow materially constrains real-world exploitation.
An authentication bypass in the EthPress - Web3 Login WordPress plugin, affecting all versions up to and including 2.3.5, allows unauthenticated remote attackers to log in as any WordPress user with a linked Ethereum wallet address - including administrators - simply by supplying that user's public wallet address together with an arbitrary, well-formed (but invalid) signature, resulting in full site takeover. The root cause is a missing return statement in verify_login() that lets execution fall through to the cookie-setting login routine even when signature verification fails; no public exploit code has been identified at time of analysis, and the assessment rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the 'high' attack complexity reflecting the need to discover a valid linked wallet address rather than any authentication barrier. Because exploitation is unauthenticated and requires no user interaction, any site where at least one account (especially an administrator) has linked a wallet should be treated as exposed until patched or the plugin is disabled.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
PHP Object Injection in the Reycob Product Import Export plugin (versions up to and including 2.3.0) allows an authenticated attacker with the WooCommerce 'Shop manager' role or higher to submit crafted serialized data, potentially achieving arbitrary code execution if a suitable POP gadget chain is present in the loaded PHP codebase. The vulnerability is network-exploitable (CVSS 3.1: 7.2 HIGH, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but the high-privilege requirement limits exploitation to trusted roles. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated SQL injection in the WordPress/WooCommerce plugin Product Filter by WBW (versions 3.1.7 and earlier) lets any remote visitor inject SQL through the plugin's public-facing product-filter functionality and read arbitrary data from the site's database, with no login and no victim interaction required. The reporting source (Patchstack) and ENISA EUVD both classify this as a high-severity SQLi, while the assessed vector constrains the impact to confidentiality only (C:H/I:N/A:N) rather than the scope-change-plus-availability model that produces the 9.3 headline score, so the practical effect is large-scale data disclosure rather than remote code execution or denial of service. No public exploit code has been identified and there is no evidence of active exploitation at time of analysis; exploitation depends solely on whether the affected plugin is installed, active, and reachable on a standard WordPress deployment.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
Reflected cross-site scripting (XSS) in the Ninja Forms WordPress plugin through version 3.15.3 allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser when the victim is tricked into loading a crafted link (UI:R). Reported by Patchstack, no public exploit identified at time of analysis, and the assessed impact is limited to client-side script execution within the site origin due to required user interaction and no server-side code execution. The CVE record assigns a CVSS score of 7.1, but our independent assessment notes no availability impact (A:N) and characterizes the issue as moderate severity.