WordPress
Monthly
Unauthenticated broken access control in the Online Booking & Scheduling Calendar for WordPress by vcita plugin (slug meeting-scheduler-by-vcita) through version 4.6.0 lets remote attackers reach protected plugin functionality without logging in and use it to modify data or settings, with the assessed vector (AV:N/AC:L/PR:N/UI:N) showing no privileges or user interaction required. Impact is limited to integrity (C:N/I:H/A:N) - booking, scheduler, or configuration data can be altered, while confidentiality and availability are not reported as affected. No CISA KEV entry is present and no public exploit identified at time of analysis; the advisory does not disclose the specific endpoint or action, which currently raises the effort of exploitation even though the vulnerability is remotely reachable.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Reflected cross-site scripting in the Razorpay Payment Button WordPress plugin (versions ≤ 2.4.9) allows unauthenticated attackers to inject arbitrary web script or HTML via a crafted link that a victim must click. The vulnerability requires user interaction (UI:R) and impacts the victim's browser session, with no server-side compromise. Despite a vendor CVSS score of 7.1, the real-world risk is modest due to the mandatory user interaction and limited scope of impact; no public exploit code or active exploitation is reported at this time.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the Mollie Forms WordPress plugin (versions up to and including 2.11.0) lets a remote attacker who holds an authenticated Contributor-level account on the target site inject arbitrary SQL through plugin-supplied input, potentially exposing sensitive data stored in the WordPress database. The issue is network-reachable with low attack complexity and requires no user interaction, but exploitation is gated by the need to first obtain Contributor credentials, so sites that disable open registration or tightly control Contributor accounts are substantially less exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released fixed version is stated in the available data. Reported by Patchstack and tracked as EUVD-2026-85467; the independent assessment rates the impact as high confidentiality with limited integrity and availability effects under an unchanged-scope vector.
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Unauthenticated attackers can permanently lock any user account - including an administrator's - out of WordPress sites running WP Recipe Maker versions 9.8.0 through 10.8.1. The plugin exposes a REST route that performs no authorization check and imposes no size limit on the data it writes, so an anonymous request can push unlimited content into a target user's metadata until that account can no longer load. Exploitation requires only that a vulnerable plugin version be installed on a default configuration; no credentials or user interaction are needed, and no public exploit code has been identified at time of analysis. The result is a denial-of-service lockout with possible limited integrity impact from metadata tampering, not a privilege escalation or data disclosure.
Identity-assertion confusion in the WP OAuth Server (Login with WordPress) plugin before 6.4.0 allows a user holding a Subscriber-level account or above to obtain a validly signed OpenID Connect identity assertion belonging to another user - including an administrator - and use it to authenticate as that victim at any relying application that trusts the WordPress site as an SSO identity provider. The plugin fails to bind the assertion it issues to the authorization grant being exchanged, instead returning the assertion of whichever user authenticated most recently, so exploitation depends on a race/interaction window (assessed vector AC:H, UI:R) in which the targeted higher-privileged user is the most recently authenticated identity. No public exploit code was identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Unauthenticated remote code execution in the YAHMAN Add-ons WordPress plugin affects all versions before 0.9.31 when the plugin's remote-file caching feature is explicitly enabled. The plugin stores remotely fetched files in a publicly accessible cache directory without validating their type, so an attacker can plant arbitrary PHP content there and have the web server execute it, yielding code execution with full confidentiality, integrity, and availability impact (CVSS 9.0, CRITICAL; AV:N/AC:H/PR:N/UI:N). Exploitation is unauthenticated and requires no user interaction, but it is gated by the non-default cache feature and rated high complexity (AC:H), and no public exploit code was identified at time of analysis. There is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated attackers can spoof the client IP address that the divi-dash WordPress plugin (versions before 1.0.7) relies on for rate limiting and banning, allowing them to bypass throttling, ban arbitrary addresses of their choosing, and grow a stored WordPress option without bound until the site suffers denial of service. The flaw is rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), with the score driven almost entirely by the high availability impact from unbounded wp_options growth and the loss of effective rate limiting. Neither CISA KEV nor any public exploit code was identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.
Unauthenticated attackers can bypass authentication in the WordPress plugin Taxi Booking Manager for WooCommerce (Magepeople Inc.) at versions before 2.0.8, reaching plugin functionality that should require a valid session - an alternate path or channel skips the authentication check entirely. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, low-complexity, and requires no user interaction on a default install with the plugin (and WooCommerce) active; however, the all-LOW confidentiality, integrity, and availability scores mean the bypass yields only bounded access rather than full administrative takeover. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so this is a genuine unauthenticated authentication-bypass issue whose real-world priority is moderate rather than critical.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
Stored cross-site scripting in the WP Yelp Review Slider WordPress plugin (all versions up to and including 9.2) lets an unauthenticated attacker plant arbitrary JavaScript that executes in the browser of anyone viewing a page that renders the affected review slider. The payload enters through the Yelp review text pulled in by the plugin's Download Reviews import routine (wpyelp_download_source), so an anonymous party simply publishes a booby-trapped review on the target business's public Yelp listing and waits for a site administrator to import it; no WordPress account on the victim site is needed. This is a conditional, not internet-scale, risk: exploitation requires the admin to actually run an import, and code only fires for subsequent visitors to the affected page, so sites that never import reviews or that have updated past the vulnerable builds are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
Stored cross-site scripting in the Ninja Forms WordPress plugin 3.15.3 lets an unauthenticated visitor plant a script payload inside any publicly accessible form field, which the plugin then renders unescaped on the admin submission-edit screen so it executes in the browser of the high-privileged user who opens that submission. Execution is not automatic: an administrator must review the malicious submission (UI:R), but reviewing submissions is the normal operational workflow, so that interaction gate is weak in practice, and an unauthenticated attacker can plant the payload at will (PR:N). Publicly available exploit code exists and the issue was reported by WPScan; the provided data contains no CISA KEV listing or EPSS score, so there is no confirmation of active exploitation, and our independent assessment rates the impact as changed-scope XSS with low confidentiality and integrity loss and no availability loss, rather than the higher 8.8 score carried alongside the CVE record.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution in The Welcomizer WordPress plugin versions up to and including 2.8.1 lets authenticated users with Subscriber-level access or higher execute arbitrary PHP on the server by abusing the twiz_ajax_callback AJAX action's savesection handler. The handler checks a nonce but omits a current_user_can() capability check, and eval() processes attacker-supplied PHP from the twiz_custom_logic POST parameter when output is set to twiz_logic_output; the nonce is exposed to any authenticated user via twiz-ajax.js.php, so it does not prevent exploitation. Wordfence reports this with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Reflected cross-site scripting in the WordPress plugin Estatik Real Estate Plugin (versions 4.0.1 through 4.3.4) lets remote attackers inject arbitrary script into an unauthenticated AJAX response by supplying crafted values in a request parameter that the plugin decodes and reflects without sanitisation or escaping. No authentication is required to reach the vulnerable endpoint, but the victim must be induced to open an attacker-controlled link (UI:R), so the practical risk is highest when a logged-in administrator is lured into clicking, granting script execution in their session context. Publicly available exploit code exists and the vendor has shipped a fix in 4.3.5; the vendor vector scores 7.1 High, while our own assessment places impact at C:L/I:L/A:N.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Shortcode injection in the WP Recipe Maker plugin for WordPress (all versions up to and including 10.8.1) lets an attacker plant arbitrary registered shortcode tokens inside the content of an approved wprm-comment-rating comment, which the plugin later feeds through do_shortcode() during recipe metadata generation and reflects into the JSON-LD reviewBody field served on every recipe page render. Because execution occurs before the plugin's strip_shortcodes()/wp_strip_all_tags() cleanup runs on the resulting string, output from sensitive shortcodes (attachment captions, private post fields, other data exposed by installed shortcodes) can be disclosed to any visitor loading the affected page. The CVSS vector records PR:N, so the injection itself is unauthenticated, but practical exploitation is gated by the site's comment-approval threshold and by whether installed shortcodes actually expose sensitive content; the vendor score of 9.1 is assessed as inflated relative to an AC:H/I:L reality, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Stored cross-site scripting in the WordPress plugin Asset CleanUp: Page Speed Booster (all versions through 1.4.0.5) lets unauthenticated visitors inject arbitrary script through comment content, which then executes in the browser of any user who subsequently loads the affected page. The flaw is gated by a non-default configuration: the combine_loaded_css CSS-combining optimization must be explicitly enabled, and the site must accept comments, so most default installs are not exposed; the independent assessment rates exploitation complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) with impact confined to client-side script execution rather than server compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is present in the provided intelligence.
Arbitrary file upload in WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, and Lets-Box/Box) versions 2.0 through 3.8.3 lets attackers with subscriber-level access write executable files to the WordPress uploads directory, enabling remote code execution (CVSS 8.8). The vulnerable download_file_to_uploads function is reachable through an import AJAX action that is also registered via wp_ajax_nopriv_ and lacks a capability check in can_import(), so the effective authentication prerequisite may be lower than the CVSS PR:L rating suggests, though exploitation still requires one of the four plugins installed and active and depends on the host allowing PHP execution inside wp-content/uploads. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Popup Maker WordPress plugin (all versions up to and including 1.24.0) allows unauthenticated visitors to inject arbitrary web scripts through the values[Name] field of an optin, newsletter, or subscriber form, with the payload stored server-side and later rendered in the WordPress admin. Execution is not automatic: it is gated on a logged-in administrator opening the Popup Maker Subscribers list table and clicking a contextual help-tab anchor, which routes the attacker-controlled value into the jQuery(link.attr('href')) DOM sink in wp-admin/js/common.js. The vendor/Wordfence CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), though the required privileged admin interaction is better reflected as UI:R; no public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
An authorization bypass in the Master Addons for Elementor WordPress plugin (all versions up to and including 3.2.2) lets any authenticated user with Contributor-level access or above rename, alter metadata on, or permanently delete arbitrary posts on the site. The flaw is a missing authorization check (CWE-862) in the plugin's popup-builder admin code: because the jltma_popup custom post type is registered with capability_type='post', Contributors can reach the edit-jltma_popup screen, harvest the nonce emitted there, and supply an attacker-controlled popup_id to reach posts they do not own. Exploitation requires an authenticated low-privilege account and no user interaction (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a genuine priority for affected sites rather than a mass-exploitation emergency - exposure concentrates on sites with open registration or multiple untrusted authors.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
Unauthenticated SQL injection in WP Multi Store Locator Pro, affecting all versions up to and including 4.5.1, lets any anonymous visitor append arbitrary SQL to the plugin's store search query and read sensitive data from the underlying WordPress database, including user credential hashes and other plugin or core records. The vulnerable entry point is the store_locatore_search_radius parameter, handled by an AJAX action registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, so the only prerequisite is that the plugin is installed and active on a default WordPress site. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation intelligence is thin, but the code path is trivially reachable and the numeric, unquoted SQL context defeats WordPress's addslashes-based request sanitization, which supports the assessed CVSS 7.5 (C:H, no integrity or availability impact).
Authenticated attackers holding only Subscriber-level access on a WordPress site can overwrite arbitrary user metadata through the Mapster WP Maps plugin (all versions up to and including 1.23.0), because the my_profile_update() handler forwards an attacker-controlled acf-photo-gallery-groups POST meta key and value directly into update_user_meta() with no nonce verification, no capability check, and no allowlist of permitted keys. Independent assessment rates the practical impact as integrity-only: the vendor description explicitly states privilege escalation is not possible, so Wordfence's CVSS 8.8 vector (C:H/I:H/A:H) is materially overstated and should be read as an arbitrary user-meta write primitive rather than a confidentiality or availability compromise or an admin-takeover path. Exploitation requires the site to permit low-privilege registration (or the attacker to otherwise obtain a Subscriber account), and no public exploit code was identified at time of analysis; no KEV or EPSS data was supplied.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Privilege escalation in the Booking Calendar plugin for WordPress (wpdevelop, cpe:2.3:a:wpdevelop:booking_calendar) in all versions up to and including 11.8.2 lets an authenticated user holding Editor-level capabilities or higher promote themselves to Administrator and seize control of the site. The wpbc_ajax_option_save AJAX action writes an attacker-supplied option name straight into update_option() because the handler's per-option safeguards only cover names explicitly registered via register_option_policy(), so unregistered options - including core WordPress settings - receive an empty policy and skip every can_save, force_mode, and allowed_keys check; an attacker can therefore set default_role=administrator and users_can_register=1 and then register a new administrative account. The embedded nonce check offers no real barrier since both the nonce value and nonce action are attacker-controlled POST parameters and a valid nonce can be fetched from admin-ajax.php?action=rest-nonce; exploitation requires an authenticated Editor+ account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per our assessment), no public exploit code has been identified at time of analysis.
An authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to and including 1.1.4, allowing any authenticated user with subscriber-level access or above to delete arbitrary gallery records - including their filters, image mappings, settings, and details options - by supplying attacker-controlled gallery IDs. The delete handler never verifies ownership or capabilities, and the accompanying nonce check can be evaded simply by omitting the nonce POST field entirely, although a present-but-invalid nonce is correctly rejected. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1), and no public exploit code and no confirmed active exploitation were identified at time of analysis; sites that permit open user self-registration are the most exposed, so vendor CVSS 8.1 is well supported by the description.
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
Unauthenticated stored cross-site scripting in the iGMS Direct Booking WordPress plugin (all versions before 2.0) lets any remote attacker write arbitrary JavaScript into the plugin's widget appearance settings, which is then rendered without escaping and executes in the browser of an administrator opening the settings page or of any visitor viewing a page that displays the booking widget. The write itself requires no credentials (CVSS vector PR:N) and no privileged configuration, so default installations are exposed; however, the payload only fires when a victim loads the affected page (UI:R), and the assessed impact is limited to low confidentiality and integrity with scope change (S:C/C:L/I:L/A:N) rather than the higher CIA values in the NVD base score. Exploitation is realistic rather than theoretical: publicly available exploit code exists, WPScan published the advisory, and a vendor fix is available in version 2.0 - multiple signals converge on this being a genuine priority rather than a paper tiger.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).
Unauthenticated SQL injection in the WordPress plugin 'Product Question and Answer' (versions through 1.1.0) lets remote attackers inject arbitrary SQL through AJAX actions that are explicitly exposed to logged-out users, enabling exfiltration of sensitive database contents such as user credential hashes and other site data. The flaw requires no authentication, no user interaction, and no non-default configuration - only that the plugin is installed and active - and publicly available exploit code exists via the WPScan proof-of-concept, so the exploitation barrier is low; there is no indication of confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), slightly below the 8.6 feed score which assumes a scope change; the practical risk driver is the confidentiality-only, full-database read impact combined with trivial remote reachability.
Unauthenticated SQL injection in the Price Drop Alert for Woo Commerce WordPress plugin (all versions through 1.1) allows any remote attacker to inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the underlying WordPress database, including user credential hashes, WooCommerce order and customer records, and stored configuration secrets. Publicly available exploit code exists and the issue was reported by WPScan, but there is no CISA KEV listing and no confirmed evidence of widespread exploitation, so the practical risk is concentrated on the subset of WordPress sites that actually run this niche WooCommerce add-on. No vendor-released patch has been identified at time of analysis, meaning the only reliable mitigation today is deactivating and removing the plugin or virtually patching the AJAX endpoint.
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions before 1.8.15) allows unauthenticated visitors to attach files to the plugin's live-chat feature whose type is not restricted and whose contents are not sanitized, so injected active content executes in the authenticated session of an administrator or staff member who opens the conversation. Injection needs no authentication, but successful execution is gated on user interaction - the targeted admin must view the malicious attachment in the WordPress admin area - and publicly available exploit code exists, with no CISA KEV confirmation of active exploitation. Note that the vendor's 8.8 score overstates the risk for what is fundamentally a cross-site scripting flaw with low confidentiality and integrity impact and no availability impact.
Stored cross-site scripting (XSS) in the Easy Form Builder by WhiteStudio WordPress plugin (versions 4.0.0 up to but not including 4.2.0) lets unauthenticated attackers submit crafted values to certain form types that are stored and later rendered without escaping in an administrator-facing submissions page. Publicly available exploit code exists, and the vendor has released version 4.2.0 to fix the flaw. Our independent assessment rates this as a scope-changed XSS with low confidentiality and integrity impact, lower than the vendor’s 8.8 CVSS score, because the payload only executes when a privileged user views the plugin’s admin page.
Remote code execution in the AF Companion WordPress plugin before version 2.2.0 lets an authenticated user who holds the plugin's low-privileged 'store-management' role upload arbitrary files, including PHP, through an import feature that performs no file-type validation. Because the uploaded PHP is executable by the web server, an attacker with that mid-tier account - a WooCommerce shop-manager-tier role rather than a full administrator - can place and run code on the host with no user interaction and no non-default configuration required. Publicly available exploit code exists for this issue, and the vendor has released version 2.2.0 to fix it; the practical limiting factor is the authenticated mid-tier role, so sites that never delegate store-management accounts to untrusted parties face materially lower risk.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
Unauthenticated stored cross-site scripting in WordPress core allows an attacker to plant a DOM-based script payload through the public comment feature and have it execute in the browser of any visitor or administrator who later views the affected page. The flaw is reachable on a default installation, because comment moderation is disabled by default and the requirement that a commenter have a previously approved comment can be bypassed; impact is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the injected script only fires once someone opens the affected content. Every core branch from 4.7 through 7.1 below its fixed maintenance release is affected, and at time of analysis no public exploit code was identified, though the low skill floor and the default-configuration reachability make it a genuine patching priority.
PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.
Authentication bypass in the FaustWP WordPress plugin before 1.8.11 lets an authenticated low-privilege user (PR:L - for example a Subscriber) tamper with a valid authorization-code envelope and obtain an Administrator access token, enabling full WordPress REST API access, administrator-account creation, plugin installation, and ultimately arbitrary code execution (CVSS 8.8, CWE-345). Because the token HMAC does not cover the 16-byte AES-CBC initialization vector, XOR-ing a few bits into the IV deterministically rewrites the first decrypted block so that a Subscriber's "ac|2|<exp>" authorization code becomes "at|1|<exp>" - an admin access token - while the HMAC still validates. Exploitation is network-reachable and needs only a logged-in account able to call GET /generate plus the plugin's headless auth flow being active; no admin privileges and no victim interaction are required. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though the published patch diff and regression tests make the technique trivially reproducible.
Reflected cross-site scripting in the WordPress plugin WP Inventory Manager (versions up to and including 2.5.4) lets unauthenticated remote attackers inject arbitrary script that executes in the browser of a user who opens a crafted URL on an affected site. Exploitation requires user interaction (UI:R) - the victim must be lured into rendering the malicious request - but no authentication is needed (PR:N) and default configurations are vulnerable; impact is scoped to the victim's browser session, making an authenticated administrator the highest-value target. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment), this is not reported as confirmed actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the specific vulnerable parameter and endpoint are not named in available reporting.
Cross-site request forgery in the Xagio SEO WordPress plugin (all versions up to and including 7.1.0.43) allows an unauthenticated attacker to make a logged-in user's browser submit a state-changing plugin request without a valid nonce or CSRF token. Because the request rides the victim's existing session, the practical impact is highest when the tricked user is a WordPress administrator, though our independent assessment bounds the effect to integrity-only, limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) rather than the 8.8 high-integrity/high-availability score in the CVE record. No public exploit identified at time of analysis, and no EPSS score was supplied with the source data; the vulnerability was reported by Patchstack and tracked as EUVD-2026-81519.
Unauthenticated broken access control in the Online Booking & Scheduling Calendar for WordPress by vcita plugin (slug meeting-scheduler-by-vcita) through version 4.6.0 lets remote attackers reach protected plugin functionality without logging in and use it to modify data or settings, with the assessed vector (AV:N/AC:L/PR:N/UI:N) showing no privileges or user interaction required. Impact is limited to integrity (C:N/I:H/A:N) - booking, scheduler, or configuration data can be altered, while confidentiality and availability are not reported as affected. No CISA KEV entry is present and no public exploit identified at time of analysis; the advisory does not disclose the specific endpoint or action, which currently raises the effort of exploitation even though the vulnerability is remotely reachable.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Reflected cross-site scripting in the Razorpay Payment Button WordPress plugin (versions ≤ 2.4.9) allows unauthenticated attackers to inject arbitrary web script or HTML via a crafted link that a victim must click. The vulnerability requires user interaction (UI:R) and impacts the victim's browser session, with no server-side compromise. Despite a vendor CVSS score of 7.1, the real-world risk is modest due to the mandatory user interaction and limited scope of impact; no public exploit code or active exploitation is reported at this time.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the Mollie Forms WordPress plugin (versions up to and including 2.11.0) lets a remote attacker who holds an authenticated Contributor-level account on the target site inject arbitrary SQL through plugin-supplied input, potentially exposing sensitive data stored in the WordPress database. The issue is network-reachable with low attack complexity and requires no user interaction, but exploitation is gated by the need to first obtain Contributor credentials, so sites that disable open registration or tightly control Contributor accounts are substantially less exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released fixed version is stated in the available data. Reported by Patchstack and tracked as EUVD-2026-85467; the independent assessment rates the impact as high confidentiality with limited integrity and availability effects under an unchanged-scope vector.
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Unauthenticated attackers can permanently lock any user account - including an administrator's - out of WordPress sites running WP Recipe Maker versions 9.8.0 through 10.8.1. The plugin exposes a REST route that performs no authorization check and imposes no size limit on the data it writes, so an anonymous request can push unlimited content into a target user's metadata until that account can no longer load. Exploitation requires only that a vulnerable plugin version be installed on a default configuration; no credentials or user interaction are needed, and no public exploit code has been identified at time of analysis. The result is a denial-of-service lockout with possible limited integrity impact from metadata tampering, not a privilege escalation or data disclosure.
Identity-assertion confusion in the WP OAuth Server (Login with WordPress) plugin before 6.4.0 allows a user holding a Subscriber-level account or above to obtain a validly signed OpenID Connect identity assertion belonging to another user - including an administrator - and use it to authenticate as that victim at any relying application that trusts the WordPress site as an SSO identity provider. The plugin fails to bind the assertion it issues to the authorization grant being exchanged, instead returning the assertion of whichever user authenticated most recently, so exploitation depends on a race/interaction window (assessed vector AC:H, UI:R) in which the targeted higher-privileged user is the most recently authenticated identity. No public exploit code was identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Unauthenticated remote code execution in the YAHMAN Add-ons WordPress plugin affects all versions before 0.9.31 when the plugin's remote-file caching feature is explicitly enabled. The plugin stores remotely fetched files in a publicly accessible cache directory without validating their type, so an attacker can plant arbitrary PHP content there and have the web server execute it, yielding code execution with full confidentiality, integrity, and availability impact (CVSS 9.0, CRITICAL; AV:N/AC:H/PR:N/UI:N). Exploitation is unauthenticated and requires no user interaction, but it is gated by the non-default cache feature and rated high complexity (AC:H), and no public exploit code was identified at time of analysis. There is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated attackers can spoof the client IP address that the divi-dash WordPress plugin (versions before 1.0.7) relies on for rate limiting and banning, allowing them to bypass throttling, ban arbitrary addresses of their choosing, and grow a stored WordPress option without bound until the site suffers denial of service. The flaw is rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), with the score driven almost entirely by the high availability impact from unbounded wp_options growth and the loss of effective rate limiting. Neither CISA KEV nor any public exploit code was identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress (before 2.1.72) lets any authenticated user with subscriber-level access or higher read other vendors' payout pages, financial reports, and dashboard content by submitting an arbitrary vendor user ID to the marketking_get_page_content AJAX action. Exploitation is a single parameter-tampering request over the network with no victim interaction, but it requires a valid low-privilege session on a site that runs the plugin as an active marketplace with vendor accounts holding financial data, as reflected in the assessed CVSS vector (PR:L, UI:N). Impact is limited to confidentiality - no modification or denial of service is possible - and no public exploit code has been identified at time of analysis; the vendor has released a fix in 2.1.72.
Authenticated subscriber-level users can retrieve the complete vendor directory from WordPress sites running MarketKing before 2.1.72 by invoking the marketking_admin_vendors_ajax AJAX action, which lacks a capability check. This exposes internal user IDs, usernames, and email addresses of all registered vendors to any logged-in user, making it a personally identifiable information disclosure issue rather than code execution or data modification. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low-to-moderate because exploitation requires an account, though open registration on marketplace sites can lower that barrier.
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.
Unauthenticated attackers can bypass authentication in the WordPress plugin Taxi Booking Manager for WooCommerce (Magepeople Inc.) at versions before 2.0.8, reaching plugin functionality that should require a valid session - an alternate path or channel skips the authentication check entirely. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, low-complexity, and requires no user interaction on a default install with the plugin (and WooCommerce) active; however, the all-LOW confidentiality, integrity, and availability scores mean the bypass yields only bounded access rather than full administrative takeover. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so this is a genuine unauthenticated authentication-bypass issue whose real-world priority is moderate rather than critical.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. Wordfence reported the issue with a CVSS 3.1 base score of 7.2 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, meaning exploitation also depends on a privileged user viewing the injected data; no public exploit code and no CISA KEV entry were identified at time of analysis, and exploitation additionally requires a WooCommerce store with the plugin active and at least one bundle product available for ordering.
Stored cross-site scripting in the WP Yelp Review Slider WordPress plugin (all versions up to and including 9.2) lets an unauthenticated attacker plant arbitrary JavaScript that executes in the browser of anyone viewing a page that renders the affected review slider. The payload enters through the Yelp review text pulled in by the plugin's Download Reviews import routine (wpyelp_download_source), so an anonymous party simply publishes a booby-trapped review on the target business's public Yelp listing and waits for a site administrator to import it; no WordPress account on the victim site is needed. This is a conditional, not internet-scale, risk: exploitation requires the admin to actually run an import, and code only fires for subsequent visitors to the affected page, so sites that never import reviews or that have updated past the vulnerable builds are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated shortcode injection in the WP Ultimate Review WordPress plugin (Roxnor) allows any user with subscriber-level access or higher to run arbitrary registered shortcodes on sites running version 2.4.2 or earlier. The attacker passes a crafted value to a plugin action that feeds it into do_shortcode() without validation (CWE-94), yielding high confidentiality and integrity impact per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but on sites with open registration the subscriber prerequisite is trivial to satisfy, and the real-world severity is bounded by which powerful shortcodes are registered by this or other installed plugins and themes - arbitrary operating-system command execution is not guaranteed.
Authenticated attackers with subscriber-level access or above can trash or restore any post, page, or custom post type on WordPress sites running the WP Table Builder - Drag & Drop Table Builder plugin in versions up to and including 2.2.1. The vulnerability arises from a broken authorization check in the plugin's trash_table_bulk() and restore_table_bulk() functions, where an operator precedence bug prevents the intended post-type guard from executing and the permission callback only verifies plugin role membership without per-post-type or ownership checks. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires an authenticated foothold but no user interaction, resulting in high availability impact and limited integrity impact with no confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.
Stored cross-site scripting in the Ninja Forms WordPress plugin 3.15.3 lets an unauthenticated visitor plant a script payload inside any publicly accessible form field, which the plugin then renders unescaped on the admin submission-edit screen so it executes in the browser of the high-privileged user who opens that submission. Execution is not automatic: an administrator must review the malicious submission (UI:R), but reviewing submissions is the normal operational workflow, so that interaction gate is weak in practice, and an unauthenticated attacker can plant the payload at will (PR:N). Publicly available exploit code exists and the issue was reported by WPScan; the provided data contains no CISA KEV listing or EPSS score, so there is no confirmation of active exploitation, and our independent assessment rates the impact as changed-scope XSS with low confidentiality and integrity loss and no availability loss, rather than the higher 8.8 score carried alongside the CVE record.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Privilege escalation in the CMP - Coming Soon & Maintenance plugin by NiteoThemes for WordPress, affecting all versions up to and including 4.1.17, lets authenticated attackers with Editor-level access or above rewrite arbitrary WordPress options through the unprotected 'cmp_ajax_import_settings' AJAX action. By pointing the site's default_role at administrator and switching on users_can_register, the attacker can self-register a brand-new administrative account and take full control of the site; the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation that requires a valid high-privilege session but no user interaction. Remediation status: upstream fix available (WordPress.org plugin repository changeset); released patched version not independently confirmed. Exploitation status: no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.
Unauthenticated privilege escalation to WordPress Administrator in the Meta Box AIO plugin (versions up to and including 3.11.0) - and in the standalone Meta Box Frontend Submission (≤4.5.6) and Meta Box User Profile (≤3.11.0) plugins - lets remote attackers rewrite the post_content of any page with an attacker-supplied shortcode and then create a new administrative account. The exploit chains three defects: populate_via_query_string() in mb-frontend-submission unconditionally overrides the form's target object_id from the rwmb_frontend_field_object_id GET parameter, Form::process() omits the user_can_edit() check that render() enforces, and mb-user-profile trusts the role and auto_login attributes of an injected [mb_user_profile_register] shortcode without validating the requested role. The flaw is network-reachable with PR:N/UI:N per the assessed CVSS 3.1 vector (9.8), so no authentication, user interaction, or prior privileges are required; Wordfence disclosed the issue, publicly available exploit code has not been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. The practical exposure limiter is deployment-specific: the site must expose a Meta Box frontend-submission form and must process the mb-user-profile registration component for the escalation to complete.
Unauthenticated arbitrary file upload in the Web to Print Online Designer WordPress plugin (versions 1.7.0 through before 2.15.0) allows any remote visitor to obtain the token that protects the plugin's upload handler and then push arbitrary files, including PHP scripts, into a web-reachable location - resulting in remote code execution with total confidentiality, integrity, and availability impact (CVSS 9.8). No authentication, user interaction, or non-default configuration is required; the plugin simply fails to validate file type or extension and discloses the upload token to anonymous requesters. Publicly available exploit code exists, so weaponization against exposed installations is a realistic short-term risk, although the vendor (WPScan-reported) has shipped a fix in 2.15.0 and EPSS currently rates near-term exploitation probability low at 0.14% (4th percentile), tracking the plugin's comparatively small install base.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Authenticated users with subscriber-level access or higher can execute arbitrary WordPress shortcodes through the ProfilePress plugin (slug wp-user-avatar) in all versions up to and including 4.17.2, because user-controlled values reach do_shortcode() without validation. Exploitation requires a low-privilege account, which is trivially obtained on sites that enable the plugin's self-service registration feature, and no user interaction is needed; however, the practical impact is variable and often limited, since substantial confidentiality or integrity loss only materializes when other privileged or data-exposing shortcodes are registered on the same site. The vendor's upstream severity rating is 8.1, while independent assessment rates the realistic vector as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (limited C/I, no availability impact); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution in The Welcomizer WordPress plugin versions up to and including 2.8.1 lets authenticated users with Subscriber-level access or higher execute arbitrary PHP on the server by abusing the twiz_ajax_callback AJAX action's savesection handler. The handler checks a nonce but omits a current_user_can() capability check, and eval() processes attacker-supplied PHP from the twiz_custom_logic POST parameter when output is set to twiz_logic_output; the nonce is exposed to any authenticated user via twiz-ajax.js.php, so it does not prevent exploitation. Wordfence reports this with CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync WordPress plugin in any version before 2.1.7, because one of its REST API endpoints performs no authorization check (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is trivial and publicly available exploit code exists, though the leak only yields credentials on sites that have completed the MgoSync WooCommerce credential setup; from there, read/write access to the connected store's REST API further depends on that API being reachable and the leaked key retaining its original scope. The vendor has released 2.1.7, and because the exposed key is read/write, credential rotation - not patching alone - is required to close the exposure.
SQL injection in the VikRentItems Flexible Rental Management System WordPress plugin lets unauthenticated remote attackers pass crafted parameters into backend SQL statements, extracting database contents such as user credentials and booking records. All plugin versions below 1.2.4 are affected, and publicly available exploit code exists. The impact is confidentiality-only at high severity (assessed CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and the practical risk is bounded by the plugin's narrow install base rather than by any technical precondition, since no authentication or user interaction is needed.
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.
Account takeover of any user of the UsersWP WordPress plugin - administrators included - is possible on sites running versions before 1.5.10 when social login is enabled, because the plugin resolves an incoming social-login session to an existing local account using the email address asserted by the provider without first confirming that the provider actually verified ownership of that address. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 8.1, CWE-269) and publicly available exploit code exists, so an attacker who registers at a lax or attacker-controlled provider can assert a victim's email and be logged into that victim's account. Exploitation carries the elevated complexity reflected in the AC:H rating: social login must be configured and enabled with at least one provider that permits assertion of an unverified address, and the attacker must already know the target's registered email. This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper cut, since successful exploitation yields full account control including administrative takeover of the site.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Reflected cross-site scripting in the WordPress plugin Estatik Real Estate Plugin (versions 4.0.1 through 4.3.4) lets remote attackers inject arbitrary script into an unauthenticated AJAX response by supplying crafted values in a request parameter that the plugin decodes and reflects without sanitisation or escaping. No authentication is required to reach the vulnerable endpoint, but the victim must be induced to open an attacker-controlled link (UI:R), so the practical risk is highest when a logged-in administrator is lured into clicking, granting script execution in their session context. Publicly available exploit code exists and the vendor has shipped a fix in 4.3.5; the vendor vector scores 7.1 High, while our own assessment places impact at C:L/I:L/A:N.
Privilege escalation in the WordPress plugin WP Import Export Lite before version 3.9.35 lets an authenticated user who holds only the delegated import permission create new administrator accounts and overwrite the credentials and roles of existing accounts, including administrators, because the import routine never verifies user-management capabilities. The flaw is only exploitable on sites that actually delegate the import capability to a non-administrator role; default WordPress installations that restrict imports to administrators gain nothing from it. Publicly available exploit code exists, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has released a fixed version.
Arbitrary PHP function invocation in the Save as PDF Plugin by PDFCrowd for WordPress (all versions up to and including 4.6.1) allows any authenticated user with Contributor-level access or higher to have the server AES-encrypt an attacker-chosen pdf_created_callback value into a valid button blob, which is later passed to PHP as a callable when any unauthenticated visitor POSTs that blob to the wp_ajax_nopriv_save_as_pdf_pdfcrowd AJAX endpoint. Published CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our assessment retains the High rating but bounds the impact to C:H/I:L/A:L because the invoked callback receives only the plugin's options array as its single, fixed argument, making disclosure of the site's stored PDFCrowd API key and username the most reliable outcome rather than fully attacker-controlled code execution. Contributors are required only to mint the blob - the trigger replay is unauthenticated - and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Shortcode injection in the WP Recipe Maker plugin for WordPress (all versions up to and including 10.8.1) lets an attacker plant arbitrary registered shortcode tokens inside the content of an approved wprm-comment-rating comment, which the plugin later feeds through do_shortcode() during recipe metadata generation and reflects into the JSON-LD reviewBody field served on every recipe page render. Because execution occurs before the plugin's strip_shortcodes()/wp_strip_all_tags() cleanup runs on the resulting string, output from sensitive shortcodes (attachment captions, private post fields, other data exposed by installed shortcodes) can be disclosed to any visitor loading the affected page. The CVSS vector records PR:N, so the injection itself is unauthenticated, but practical exploitation is gated by the site's comment-approval threshold and by whether installed shortcodes actually expose sensitive content; the vendor score of 9.1 is assessed as inflated relative to an AC:H/I:L reality, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the Forminator Forms plugin (all versions up to and including 1.57.2) because a value reaching do_shortcode in the quizzes front-action handler is not properly validated. A site is only reachable through this path if Forminator is installed and active and a form or quiz routes through the vulnerable front-action, and the real-world damage is bounded by which shortcodes other installed plugins register - benign shortcodes mean limited impact, while data- or state-changing shortcodes raise it substantially. No public exploit code or confirmed in-the-wild activity (CISA KEV) was identified at time of analysis; note that the vendor-assigned CVSS 9.1 overstates the assessed impact, which our analysis places at CVSS 6.5 (C:L/I:L) for fully remote, unauthenticated, low-complexity exploitation.
Unauthenticated arbitrary file upload in the Gravity Forms WordPress plugin through version 3.1.0.4 can lead to remote code execution on any site whose publicly reachable form contains a File Upload field with its Visibility set to 'Hidden', because hidden upload fields skip the extension-validation step and a rejected file's intact upload state is subsequently persisted by upload_file() without re-validation. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), no credentials or user interaction are required (PR:N/UI:N) and the attack is fully remote (AV:N), but the non-default hidden File Upload field is a mandatory precondition; a secondary practical limiter is that code execution depends on the server actually executing the uploaded file type in the upload directory. No public exploit code and no CISA KEV entry were identified at time of analysis, yet the combination of unauthenticated access, arbitrary file write and PHP-execution potential makes this a high-priority fix for any installation that meets the precondition.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Stored cross-site scripting in the WordPress plugin Asset CleanUp: Page Speed Booster (all versions through 1.4.0.5) lets unauthenticated visitors inject arbitrary script through comment content, which then executes in the browser of any user who subsequently loads the affected page. The flaw is gated by a non-default configuration: the combine_loaded_css CSS-combining optimization must be explicitly enabled, and the site must accept comments, so most default installs are not exposed; the independent assessment rates exploitation complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) with impact confined to client-side script execution rather than server compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is present in the provided intelligence.
Arbitrary file upload in WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, and Lets-Box/Box) versions 2.0 through 3.8.3 lets attackers with subscriber-level access write executable files to the WordPress uploads directory, enabling remote code execution (CVSS 8.8). The vulnerable download_file_to_uploads function is reachable through an import AJAX action that is also registered via wp_ajax_nopriv_ and lacks a capability check in can_import(), so the effective authentication prerequisite may be lower than the CVSS PR:L rating suggests, though exploitation still requires one of the four plugins installed and active and depends on the host allowing PHP execution inside wp-content/uploads. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Popup Maker WordPress plugin (all versions up to and including 1.24.0) allows unauthenticated visitors to inject arbitrary web scripts through the values[Name] field of an optin, newsletter, or subscriber form, with the payload stored server-side and later rendered in the WordPress admin. Execution is not automatic: it is gated on a logged-in administrator opening the Popup Maker Subscribers list table and clicking a contextual help-tab anchor, which routes the attacker-controlled value into the jQuery(link.attr('href')) DOM sink in wp-admin/js/common.js. The vendor/Wordfence CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), though the required privileged admin interaction is better reflected as UI:R; no public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis.
Stored cross-site scripting in the Jeg Elementor Kit WordPress plugin (all versions up to and including 3.2.16) allows unauthenticated attackers to inject arbitrary JavaScript into comment content, which then executes in the browser of any user who later views the affected page. The attack is conditional rather than universal: the targeted post must also render a legitimate Jeg Kit Countdown widget, which causes the plugin's countdown frontend script to be enqueued and to initialize on any matching DOM element - including forged Countdown widget markup smuggled into a published comment - and comments must be enabled and the malicious comment published (sites that hold first-time comments for administrator moderation break the unauthenticated path). The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while our independent assessment scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N given the widget dependency, moderation gate, and victim-visit requirement; impact is confined to client-side script execution with no availability impact, and no public exploit code has been identified at time of analysis.
An authorization bypass in the Master Addons for Elementor WordPress plugin (all versions up to and including 3.2.2) lets any authenticated user with Contributor-level access or above rename, alter metadata on, or permanently delete arbitrary posts on the site. The flaw is a missing authorization check (CWE-862) in the plugin's popup-builder admin code: because the jltma_popup custom post type is registered with capability_type='post', Contributors can reach the edit-jltma_popup screen, harvest the nonce emitted there, and supply an attacker-controlled popup_id to reach posts they do not own. Exploitation requires an authenticated low-privilege account and no user interaction (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a genuine priority for affected sites rather than a mass-exploitation emergency - exposure concentrates on sites with open registration or multiple untrusted authors.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner WordPress plugin, affecting all versions up to and including 7.5.4, allows unauthenticated attackers to embed arbitrary JavaScript in comment content that later executes in the browser of anyone viewing the approved comment page. Realistic exploitation is gated by three conditions that must all hold: a site administrator must approve the attacker's submitted comment, the Elementor page-builder plugin must be installed and active, and Complianz must be configured with the Twitter or Facebook cookie/script blocker enabled so comment content is routed through the vulnerable cookie-blocker regex path; independent assessment rates the vector as AC:H/UI:R despite PR:N, since exploitation depends on a moderator action and a specific third-party configuration. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); a vendor patch is available in version 7.5.5.
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
Unauthenticated SQL injection in WP Multi Store Locator Pro, affecting all versions up to and including 4.5.1, lets any anonymous visitor append arbitrary SQL to the plugin's store search query and read sensitive data from the underlying WordPress database, including user credential hashes and other plugin or core records. The vulnerable entry point is the store_locatore_search_radius parameter, handled by an AJAX action registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, so the only prerequisite is that the plugin is installed and active on a default WordPress site. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; exploitation intelligence is thin, but the code path is trivially reachable and the numeric, unquoted SQL context defeats WordPress's addslashes-based request sanitization, which supports the assessed CVSS 7.5 (C:H, no integrity or availability impact).
Authenticated attackers holding only Subscriber-level access on a WordPress site can overwrite arbitrary user metadata through the Mapster WP Maps plugin (all versions up to and including 1.23.0), because the my_profile_update() handler forwards an attacker-controlled acf-photo-gallery-groups POST meta key and value directly into update_user_meta() with no nonce verification, no capability check, and no allowlist of permitted keys. Independent assessment rates the practical impact as integrity-only: the vendor description explicitly states privilege escalation is not possible, so Wordfence's CVSS 8.8 vector (C:H/I:H/A:H) is materially overstated and should be read as an arbitrary user-meta write primitive rather than a confidentiality or availability compromise or an admin-takeover path. Exploitation requires the site to permit low-privilege registration (or the attacker to otherwise obtain a Subscriber account), and no public exploit code was identified at time of analysis; no KEV or EPSS data was supplied.
Unauthenticated directory traversal in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin (all versions up to and including 2.8.5) allows remote attackers to read arbitrary files on the underlying server by manipulating the 'mockups' parameter, exposing configuration files, wp-config.php-style secrets, and other sensitive data. The traversal is gated only by a 'nbdesigner-get-data' nonce, but that nonce is freely minted to anonymous visitors by the plugin's own nbd_check_use_logged_in nopriv AJAX endpoint, and the check disappears entirely if the NBDESIGNER_ENABLE_NONCE constant is disabled, so authentication requirements are effectively nil (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is limited to confidentiality - integrity and availability are unaffected, and the depth of file access is bounded by the web server user's filesystem permissions. No CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity and the absence of a confirmed patched release make exposed storefronts a high-priority remediation target.
Unauthenticated SQL injection in the WCFM Marketplace (Multivendor Marketplace for WooCommerce) WordPress plugin affects all versions up to and including 3.8.2, allowing remote attackers to inject arbitrary SQL through the 'wcfmmp_user_location_lng' parameter and read sensitive data from the underlying WordPress database. Rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no authentication, privileges, or user interaction, although practical reachability depends on the store actually exercising the plugin's location/distance-based shipping code path alongside an active WooCommerce install. No confirmed active exploitation (the issue is not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix commit is visible in the plugin repository, but a released patched version has not been independently confirmed.
Privilege escalation in the Booking Calendar plugin for WordPress (wpdevelop, cpe:2.3:a:wpdevelop:booking_calendar) in all versions up to and including 11.8.2 lets an authenticated user holding Editor-level capabilities or higher promote themselves to Administrator and seize control of the site. The wpbc_ajax_option_save AJAX action writes an attacker-supplied option name straight into update_option() because the handler's per-option safeguards only cover names explicitly registered via register_option_policy(), so unregistered options - including core WordPress settings - receive an empty policy and skip every can_save, force_mode, and allowed_keys check; an attacker can therefore set default_role=administrator and users_can_register=1 and then register a new administrative account. The embedded nonce check offers no real barrier since both the nonce value and nonce action are attacker-controlled POST parameters and a valid nonce can be fetched from admin-ajax.php?action=rest-nonce; exploitation requires an authenticated Editor+ account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H per our assessment), no public exploit code has been identified at time of analysis.
An authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to and including 1.1.4, allowing any authenticated user with subscriber-level access or above to delete arbitrary gallery records - including their filters, image mappings, settings, and details options - by supplying attacker-controlled gallery IDs. The delete handler never verifies ownership or capabilities, and the accompanying nonce check can be evaded simply by omitting the nonce POST field entirely, although a present-but-invalid nonce is correctly rejected. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1), and no public exploit code and no confirmed active exploitation were identified at time of analysis; sites that permit open user self-registration are the most exposed, so vendor CVSS 8.1 is well supported by the description.
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
Unauthenticated stored cross-site scripting in the iGMS Direct Booking WordPress plugin (all versions before 2.0) lets any remote attacker write arbitrary JavaScript into the plugin's widget appearance settings, which is then rendered without escaping and executes in the browser of an administrator opening the settings page or of any visitor viewing a page that displays the booking widget. The write itself requires no credentials (CVSS vector PR:N) and no privileged configuration, so default installations are exposed; however, the payload only fires when a victim loads the affected page (UI:R), and the assessed impact is limited to low confidentiality and integrity with scope change (S:C/C:L/I:L/A:N) rather than the higher CIA values in the NVD base score. Exploitation is realistic rather than theoretical: publicly available exploit code exists, WPScan published the advisory, and a vendor fix is available in version 2.0 - multiple signals converge on this being a genuine priority rather than a paper tiger.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin through version 1.8.1 lets remote attackers read arbitrary data from the underlying WordPress database through an AJAX action registered for unauthenticated callers. No login, role, or user interaction is required - the vulnerable endpoint is reachable by anyone who can load the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N per the assessed vector) - and publicly available exploit code exists per the WPScan report, though no confirmed active exploitation (CISA KEV) has been reported. Impact is limited to confidentiality: database read and extraction, with no write or availability impact described, and the practical risk is constrained mainly by the plugin's niche deployment footprint.
Unauthenticated SQL injection in the Tz Weekly Radio Schedule WordPress plugin (all versions through 1.8.1) lets any remote attacker inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the site's database. No login, role, or user interaction is required - the vulnerable handler is registered as an unauthenticated (nopriv) AJAX action - and publicly available exploit code exists, making this a high-priority fix for any site running the plugin. There is no confirmed evidence of active exploitation (not listed in CISA KEV), and the practical blast radius is limited by the plugin's niche install base and by the confidentiality-only impact (data extraction, with no data modification or denial of service reported).
Unauthenticated SQL injection in the WordPress plugin 'Product Question and Answer' (versions through 1.1.0) lets remote attackers inject arbitrary SQL through AJAX actions that are explicitly exposed to logged-out users, enabling exfiltration of sensitive database contents such as user credential hashes and other site data. The flaw requires no authentication, no user interaction, and no non-default configuration - only that the plugin is installed and active - and publicly available exploit code exists via the WPScan proof-of-concept, so the exploitation barrier is low; there is no indication of confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), slightly below the 8.6 feed score which assumes a scope change; the practical risk driver is the confidentiality-only, full-database read impact combined with trivial remote reachability.
Unauthenticated SQL injection in the Price Drop Alert for Woo Commerce WordPress plugin (all versions through 1.1) allows any remote attacker to inject arbitrary SQL through a publicly reachable AJAX action and read sensitive data from the underlying WordPress database, including user credential hashes, WooCommerce order and customer records, and stored configuration secrets. Publicly available exploit code exists and the issue was reported by WPScan, but there is no CISA KEV listing and no confirmed evidence of widespread exploitation, so the practical risk is concentrated on the subset of WordPress sites that actually run this niche WooCommerce add-on. No vendor-released patch has been identified at time of analysis, meaning the only reliable mitigation today is deactivating and removing the plugin or virtually patching the AJAX endpoint.
Unauthenticated SQL injection in the WordPress plugin 'wp shortcut link and advertisement baner' (all versions through 1.2.0) allows remote attackers to inject arbitrary SQL through a parameter passed to an AJAX action that is registered for non-logged-in users, exposing the site's database contents. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms the flaw is exploitable without any credentials and with no user interaction, and that impact is limited to confidentiality; publicly available exploit code exists, so scanning and exploitation attempts are feasible, though the plugin's low profile and likely abandonment mean real-world exposure is narrower than the raw 8.6 score implies. No CISA KEV listing is associated with this CVE, so confirmed active exploitation is not established. This is a genuine, actionable issue but is probably lower operational priority than the vendor score suggests, unless the plugin is actually installed on an internet-facing site.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (versions before 1.8.15) allows unauthenticated visitors to attach files to the plugin's live-chat feature whose type is not restricted and whose contents are not sanitized, so injected active content executes in the authenticated session of an administrator or staff member who opens the conversation. Injection needs no authentication, but successful execution is gated on user interaction - the targeted admin must view the malicious attachment in the WordPress admin area - and publicly available exploit code exists, with no CISA KEV confirmation of active exploitation. Note that the vendor's 8.8 score overstates the risk for what is fundamentally a cross-site scripting flaw with low confidentiality and integrity impact and no availability impact.
Stored cross-site scripting (XSS) in the Easy Form Builder by WhiteStudio WordPress plugin (versions 4.0.0 up to but not including 4.2.0) lets unauthenticated attackers submit crafted values to certain form types that are stored and later rendered without escaping in an administrator-facing submissions page. Publicly available exploit code exists, and the vendor has released version 4.2.0 to fix the flaw. Our independent assessment rates this as a scope-changed XSS with low confidentiality and integrity impact, lower than the vendor’s 8.8 CVSS score, because the payload only executes when a privileged user views the plugin’s admin page.
Remote code execution in the AF Companion WordPress plugin before version 2.2.0 lets an authenticated user who holds the plugin's low-privileged 'store-management' role upload arbitrary files, including PHP, through an import feature that performs no file-type validation. Because the uploaded PHP is executable by the web server, an attacker with that mid-tier account - a WooCommerce shop-manager-tier role rather than a full administrator - can place and run code on the host with no user interaction and no non-default configuration required. Publicly available exploit code exists for this issue, and the vendor has released version 2.2.0 to fix it; the practical limiting factor is the authenticated mid-tier role, so sites that never delegate store-management accounts to untrusted parties face materially lower risk.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
Unauthenticated stored cross-site scripting in WordPress core allows an attacker to plant a DOM-based script payload through the public comment feature and have it execute in the browser of any visitor or administrator who later views the affected page. The flaw is reachable on a default installation, because comment moderation is disabled by default and the requirement that a commenter have a previously approved comment can be bypassed; impact is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the injected script only fires once someone opens the affected content. Every core branch from 4.7 through 7.1 below its fixed maintenance release is affected, and at time of analysis no public exploit code was identified, though the low skill floor and the default-configuration reachability make it a genuine patching priority.
PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.
Authentication bypass in the FaustWP WordPress plugin before 1.8.11 lets an authenticated low-privilege user (PR:L - for example a Subscriber) tamper with a valid authorization-code envelope and obtain an Administrator access token, enabling full WordPress REST API access, administrator-account creation, plugin installation, and ultimately arbitrary code execution (CVSS 8.8, CWE-345). Because the token HMAC does not cover the 16-byte AES-CBC initialization vector, XOR-ing a few bits into the IV deterministically rewrites the first decrypted block so that a Subscriber's "ac|2|<exp>" authorization code becomes "at|1|<exp>" - an admin access token - while the HMAC still validates. Exploitation is network-reachable and needs only a logged-in account able to call GET /generate plus the plugin's headless auth flow being active; no admin privileges and no victim interaction are required. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though the published patch diff and regression tests make the technique trivially reproducible.
Reflected cross-site scripting in the WordPress plugin WP Inventory Manager (versions up to and including 2.5.4) lets unauthenticated remote attackers inject arbitrary script that executes in the browser of a user who opens a crafted URL on an affected site. Exploitation requires user interaction (UI:R) - the victim must be lured into rendering the malicious request - but no authentication is needed (PR:N) and default configurations are vulnerable; impact is scoped to the victim's browser session, making an authenticated administrator the highest-value target. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment), this is not reported as confirmed actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the specific vulnerable parameter and endpoint are not named in available reporting.
Cross-site request forgery in the Xagio SEO WordPress plugin (all versions up to and including 7.1.0.43) allows an unauthenticated attacker to make a logged-in user's browser submit a state-changing plugin request without a valid nonce or CSRF token. Because the request rides the victim's existing session, the practical impact is highest when the tricked user is a WordPress administrator, though our independent assessment bounds the effect to integrity-only, limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) rather than the 8.8 high-integrity/high-availability score in the CVE record. No public exploit identified at time of analysis, and no EPSS score was supplied with the source data; the vulnerability was reported by Patchstack and tracked as EUVD-2026-81519.