WordPress
Monthly
SQL injection in the MC Woocommerce Wishlist WordPress plugin (versions up to and including 1.9.21) allows an authenticated administrator to inject arbitrary SQL through admin-facing input, potentially exposing sensitive database contents. Although rated high on CVSS, the flaw requires an existing administrator account, so realistic risk is limited to attackers who already hold admin rights; no public exploit has been identified and there is no evidence of confirmed active exploitation per CISA KEV.
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
SQL injection in WP-Lister Lite for eBay 3.8.11 and earlier allows an authenticated user holding the WooCommerce 'Shop manager' role to inject arbitrary SQL into queries executed by the plugin, exposing database contents such as WordPress user hashes, order records, and customer personally identifiable information. The issue is remote, low complexity, and requires no user interaction, but the PR:H prerequisite narrows the practical attacker pool to insiders or actors who have already compromised a Shop-manager account, which is why the independent assessment places it in the mid-to-high band rather than an emergency tier. No vendor-released patch has been identified at time of analysis, and no public exploit identified at time of analysis; EPSS data was not supplied.
SQL injection in the SKT Addons for Elementor WordPress plugin (version 4.0 and earlier) allows an attacker who already holds a high-privilege authenticated WordPress account - PR:H in the vector, typically an Editor or Administrator able to reach the plugin's Elementor editor functionality - to inject arbitrary SQL against the site's backend database over the network with low attack complexity and no user interaction. The vendor-assigned CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment rates the same vector at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N, i.e. confidentiality-heavy database disclosure rather than a scope-changing, integrity-destroying primitive. Because exploitation is gated behind the PR:H requirement, risk is concentrated in insider misuse or in an attacker who has already chained a separate privilege compromise; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for this CVE.
SQL injection in the WC Vendors Marketplace WordPress plugin (versions up to and including 2.7.2.1) allows an authenticated WordPress administrator to inject arbitrary SQL through an admin-side marketplace parameter, putting the site's database contents at risk of disclosure. The administrator-level privilege gate (PR:H) is the dominant limiting factor: administrator accounts already hold full database and code-execution capability, so the realistic exposure is largely insider misuse or reuse of a hijacked admin session rather than attacker escalation from a low-privileged user. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is tracked as EUVD-2026-81507 following disclosure by Patchstack.
SQL injection in the WordPress plugin WPMasterToolKit affects versions 2.22.0 and earlier, allowing an attacker who already holds a WordPress Administrator session to inject arbitrary SQL through affected plugin functionality and read data from the underlying database. Exploitation requires the highest standard WordPress privilege level (PR:H per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and the assessed impact is confidentiality-only - no integrity or availability effect was confirmed - while the vulnerability has no public exploit identified at time of analysis and is not listed as confirmed actively exploited (CISA KEV). Because the required Administrator role already has broad legitimate database and site access in WordPress, this is best characterized as a high-CVSS-but-low-real-priority finding whose practical value is largely limited to insider abuse or post-compromise escalation, with no vendor-released fixed version identified at time of analysis.
SQL injection in the Tribulant Newsletters WordPress plugin (versions 4.18 and earlier) allows authenticated administrators to execute arbitrary SQL queries, leading to high-impact confidentiality breaches and low-impact integrity tampering within the WordPress database. The flaw requires an Administrator-level account (PR:H) and is remotely exploitable without user interaction, but no public exploit code has been identified at time of analysis. Our independent assessment rates this as a high-privilege, low-real-world-priority issue despite its 7.6 CVSS, because administrators can already edit plugin code and query the database directly.
SQL injection in the WP Maps WordPress plugin (Flipper Code) through version 4.9.9 lets an attacker who already holds a WordPress Administrator session inject arbitrary SQL through an admin-side parameter, exposing database contents. The vulnerable code path is administrator-only (CVSS PR:H), so the flaw cannot be triggered by unauthenticated or low-privilege users, and no public exploit code has been identified at time of analysis; reported by Patchstack (ENISA EUVD-2026-81504). This is a high-CVSS (7.6) but comparatively low real-world-priority issue once the highest-privilege prerequisite is weighed.
Authenticated SQL injection in the Rextheme Product Feed Manager WordPress plugin (slug best-woocommerce-feed) affects all versions up to and including 7.12.0 and lets an attacker with at least Contributor-level access on the site inject arbitrary SQL through the plugin's query handling. The reported CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), with the assessed vector refining this to AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so the dominant impact is high-confidentiality database disclosure rather than full site takeover. Exploitation requires a low-privileged authenticated account, which makes the risk significantly higher on sites with open registration or broadly granted Contributor/Author roles and much lower on single-admin sites; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site request forgery in the WordPress plugin Asset CleanUp: Page Speed Booster (versions up to and including 1.4.0.5) lets a remote attacker forge requests that a logged-in privileged user, typically an administrator working in the plugin's settings, unknowingly submits to the site. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) the attacker needs no credentials of their own, but a successful attack depends entirely on socially engineering an existing authenticated victim into visiting an attacker-controlled page while their WordPress session is active; there is no authentication bypass and only limited integrity impact is assessed. No public exploit code, and no confirmed active exploitation (CISA KEV), were identified at time of analysis, so this is a moderate, not top-tier, priority, reported to the vendor by Patchstack. Note that the vendor-supplied CVSS 7.1 rating is higher than the independent assessment because it assumes changed scope and low-level confidentiality and availability impact that are not supported by the described attack path.
Unauthenticated attackers can bypass the authentication logic of the miniOrange Headless Single Sign On WordPress plugin at versions up to and including 1.7.0, gaining access as arbitrary users - potentially administrators - with full confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no credentials, no user interaction, and no client-side prerequisites against an affected installation; the practical limiting factor is deployment, since this is a niche headless-SSO component with a modest install footprint, and the precise configuration state that triggers the bypass is not described in the advisory. At time of analysis there is no CISA KEV entry and no public exploit identified, so the risk is driven by the severity of the flaw and the ease of the network attack path rather than by observed exploitation. Reported by Patchstack (EUVD-2026-81491).
Unauthenticated remote code execution in Migratico Lite, a WordPress site-migration plugin, affects all versions up to and including 2.6.8 and lets a remote attacker who can reach an affected site inject and execute arbitrary code with the privileges of the web server. The vendor-disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, reported by Patchstack) requires no authentication and no user interaction, so any WordPress installation running an affected plugin version is potentially exposed; our independent assessment keeps the same network/authentication profile but scores scope as unchanged (S:U), giving an effective base score of 9.8. Exploitation is tempered by practical limits: Migratico Lite is a niche migration plugin with a modest install base, and the sparse public advisory does not disclose the vulnerable endpoint or parameter, so no public exploit code has been identified at time of analysis and weaponization currently depends on an attacker locating the injection sink themselves. There is no CISA KEV entry for this CVE.
Authentication bypass in the EduAdmin Booking WordPress plugin (all versions up to and including 5.4.2) lets an unauthenticated remote visitor reach functionality that should require a logged-in, privileged user. Patchstack rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assigned weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel); our assessment concurs on the unauthenticated, no-interaction, remotely reachable nature of the flaw but scores availability as not impacted (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), so the practical consequence is high-impact disclosure and data manipulation rather than denial of service. No entry appears in CISA KEV and no public exploit code was identified at time of analysis, so exposure is currently driven by whether the plugin is installed and network-reachable rather than by active exploitation.
Unauthenticated cross-site scripting in Visitor Traffic Real Time Statistics Pro (versions up to and including 11.21) lets any anonymous internet user craft a request or link whose payload is reflected or stored by the plugin and then executed in a victim's browser. Because the CVSS vector requires user interaction (UI:R), the attacker cannot trigger the payload without a victim rendering it, and the impact is greatest when that victim is a logged-in WordPress administrator, where script execution can lead to session hijack, credential theft, or forged admin actions. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the plugin's unauthenticated attack surface and the very broad install base of WordPress make opportunistic scanning plausible.
Unauthenticated SQL injection in the Yo WordPress plugin versions 1.1 through 1.3.1 allows remote attackers to read arbitrary database contents, including administrator password hashes. The flaw occurs because the plugin uses the username request parameter in a SQL query before WordPress applies its request escaping, so no authentication or user interaction is required. Publicly available exploit code exists, and while no confirmed active exploitation (CISA KEV) is reported, the high confidentiality impact makes this a priority for sites running the affected plugin.
Unauthenticated file upload in the To Do List Member WordPress plugin (versions 1.4 through 1.6) lets any remote attacker stage attacker-controlled files - including active content such as PHP payloads served from the site's own origin - and also enumerate and delete files already staged there. The plugin ships a standalone upload endpoint that never bootstraps WordPress, so no authentication, capability, or nonce check is ever performed, and only the uploaded filename is validated rather than the file's contents. Publicly available exploit code exists (reported by WPScan), and our assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact - no victim interaction is required, contrary to the vendor vector's UI:R - with the practical limit on real-world risk being the plugin's niche deployment footprint plus any WAF or perimeter rule that blocks direct requests to the endpoint or PHP execution in the upload directory.
Reflected cross-site scripting in the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before version 5.4.2 allows an unauthenticated attacker to inject arbitrary script into a page that is echoed back to the victim's browser, enabling session theft, credential harvesting, or malicious redirects in the context of the targeted site. Exploitation is not autonomous: the attacker must craft a link containing the payload in one of the plugin's unsanitised parameters and socially engineer a visitor - or an authenticated administrator, which materially raises the stakes - into following it, so the assessed vector requires user interaction (UI:R) and impact is confined to the victim's browser session rather than the server. Publicly available exploit code exists per the WPScan report, but there is no KEV listing indicating confirmed active exploitation; the issue is a real but moderate-priority reflected XSS in a niche WordPress plugin, with a vendor-released fix at version 5.4.2.
Privilege escalation in the PuppyFW WordPress plugin (all versions through 0.4.4) lets any authenticated user, down to a Subscriber, add, modify, and delete arbitrary blog options, which is enough to grant themselves administrative capabilities. The root cause is a REST route that performs its capability check against a capability value supplied in the request itself, so the caller effectively authorizes itself; no user interaction and no special plugin configuration are required. Publicly available exploit code exists, so sites that allow open self-registration are directly at risk, and this is a genuine high-priority issue rather than a theoretical one.
Unauthenticated remote code execution in the wpShopGermany IT-RECHT KANZLEI WordPress plugin affects every release from 1.6 up to but not including 2.4. The plugin builds its API authentication token from data the requester supplies and creates that token as a side effect of the routine that is supposed to validate it, so an attacker can compute a valid token without any credentials and use the access it grants to write arbitrary files on the server, which in a PHP/WordPress context converts directly into code execution. No authentication or user interaction is required - only network reachability to the plugin's token-authenticated API endpoint - and publicly available exploit code exists (the finding was published by WPScan). Our independent assessment rates the realistic vector as AC:L/PR:N/UI:N/S:U with high confidentiality, integrity and availability impact, a step more severe than the vendor's 9.0 AC:H/S:C rating; the practical brake on this issue is deployment scope, since this is a niche legal-compliance plugin rather than a mass-market component.
Stored cross-site scripting in the Dictionary WordPress plugin (all versions through 1.0) allows unauthenticated attackers to inject arbitrary web scripts into dictionary entries, which then execute in the browser of any user who views the poisoned entry. The add/update entry functionality is implemented with no authorization check, no input sanitization, and no output escaping, and publicly available exploit code exists (reported by WPScan); there is no CISA KEV listing, so active exploitation is not confirmed. Although the headline CVSS score is 8.8, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, placing real-world risk below the vendor score because the payload only fires when a victim views the affected entry and meaningful escalation (session/nonce theft, account takeover) requires that viewer to be an authenticated, privileged user.
Stored cross-site scripting in the Dewa Kirim WordPress plugin through 1.0.0 allows an unauthenticated visitor to inject JavaScript through the delivery-coordinates field submitted during checkout, which is then written unescaped into an inline script and executes in the browser session of any administrator who later opens the affected order in wp-admin. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.8) reflects that no authentication or special server configuration is required and the only friction is the user-interaction requirement: an admin must view the poisoned order for the payload to fire, after which a compromised admin session can lead to full site takeover. Publicly available exploit code exists, and although EPSS and KEV data were not provided, this is a credible high-priority issue within its niche install base given the unauthenticated injection path and the privileged target context.
Unauthenticated attackers can log in as any user, including administrators, in the WordPress plugin Login with QR through version 1.0.0 because it fails to verify that the QR login code was issued by the plugin, instead matching any stored user metadata value. This critical authentication bypass (CVSS 9.8) requires no authentication or user interaction and is remotely exploitable against default configurations, with publicly available exploit code but no confirmation of active exploitation in the wild. The plugin must be installed and active for exploitation, but its niche deployment footprint is the only limiting factor.
Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. The primary limiting factor is the plugin's low deployment footprint, but where present, it is a top-priority risk.
Unauthenticated attackers can log in as any WordPress user, including administrators, on sites running the Private Feed Key plugin at version 0.1 or below, because the plugin's feed-authentication check accepts any value already stored in a user's metadata instead of verifying a key that the plugin itself issued. The issue is network-reachable with no authentication or user interaction required (CVSS 3.1 9.8, CWE-287, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists; no CISA KEV listing is indicated in the available intelligence supplied for this analysis. Exposure hinges solely on whether this obscure plugin is installed and active - no non-default configuration, special platform, or privileged position is needed - which is why the independent assessment rates it a genuine top-priority vulnerability rather than a high-score-but-low-risk case.
Unauthenticated stored/reflected cross-site scripting (CWE-79) in the WordPress plugin WPLP Cookie Consent before 4.4.4 allows a remote attacker to run arbitrary JavaScript in an administrator's session by submitting a crafted value to a public endpoint that the plugin later renders, unescaped, into a JavaScript context on an administrative screen; the injection itself requires no authentication (PR:N) but execution depends on an administrator interacting with the affected admin page (UI:R), and only multisite installations are affected. Publicly available exploit code exists, which lowers the effort needed to reproduce and weaponize the payload, though no confirmed active exploitation (CISA KEV) is recorded. The vendor has released a fix in version 4.4.4, so the realistic risk is concentrated on unpatched multisite deployments where admins routinely open the affected screen.
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.
Reflected cross-site scripting in the Dictionary WordPress plugin, affecting all versions up to and including 1.0, lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Attackers must induce a victim to submit a crafted request to one of the plugin's several directly accessible scripts (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1), and publicly available exploit code exists, though there is no confirmed evidence of active exploitation in the wild. The threat is moderate and bounded: the primary limiting factor is the required user interaction, so delivery is per-target via phishing or a malicious link rather than mass, self-propagating compromise, and impact is confined to the victim's browser rather than the server.
Unauthenticated arbitrary file upload in the Multi Uploader for Gravity Forms WordPress plugin (all versions up to and including 1.1.9) lets attackers write executable files to the affected site's server through the move_file() chunked-upload handler, which applies insufficient file-type validation, making remote code execution possible. Exploitation requires the plugin to be installed and active alongside the commercial Gravity Forms plugin and a publicly reachable form that exposes a multi-uploader field; the CVSS vector (PR:N/UI:N) confirms no authentication or victim interaction is needed, though RCE additionally depends on the uploaded file landing in a web-executable location. Risk is rated high-priority (CVSS 9.8), with the practical exposure narrowed by the plugin's niche deployment and its Gravity Forms dependency; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis.
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to inject arbitrary JavaScript into a public page by luring a victim to a crafted link, with the script executing in the victim's browser under the site's origin. Because the payload lands in an unescaped HTML attribute, a logged-in administrator who opens the link can be made to run attacker-controlled code with their privileges (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), though exploitation is contingent on victim interaction and on the site using a classic (non-block) theme. Public exploit code is available and WPScan has published an advisory, but EPSS is low at 0.22% (13th percentile) and the supplied intelligence contains no CISA KEV entry indicating confirmed active exploitation; the vendor has addressed the issue in version 4.4.7.
Privilege escalation in the Tutor LMS WordPress plugin (versions 2.7.1 up to but not including 4.0.8) lets the holder of a read-only Tutor LMS REST API key act with the full privileges of the administrator account that issued that key, producing high confidentiality, integrity and availability impact and, in practice, complete takeover of the affected WordPress site. Exploitation is authenticated in the sense that the attacker must already hold a valid API credential provisioned by a site administrator - obtained through grant, leak, or capture - after which no further user interaction is required; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.2 as published with PR:H). Publicly available exploit code exists and WPScan has published the vulnerability record, but there is no indication of confirmed active exploitation (not in CISA KEV); EPSS is low at 0.17% (7th percentile), suggesting limited observed exploitation activity despite the severity of impact once a key is held.
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Stored cross-site scripting in the Optimole WordPress plugin versions 4.2.3 through 4.2.11 allows unauthenticated attackers to inject arbitrary attributes into an image tag built from an unescaped user-supplied value, with the poisoned markup then served to every visitor of the affected site. Exploitation is unauthenticated (PR:N) but requires a victim to load the page containing the injected attribute (UI:R); because the malicious content is persisted server-side, any visitor or administrator viewing that page can trigger execution. A patch is available in Optimole 4.2.12 and publicly available exploit code exists, though EPSS is low at 0.22% (13th percentile), indicating limited observed exploitation pressure at the time of analysis.
Unauthenticated SQL injection in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 lets any remote visitor inject arbitrary SQL into a query built from an unsanitised, unescaped parameter, potentially exposing the site's backend database contents. The flaw is trivially reachable - our assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N, meaning no credentials, no user interaction, and no non-default configuration are required, with impact scored to confidentiality (C:H) only. Exploitation is bounded by the fact that the target must be a WordPress site running this specific, relatively niche plugin at a vulnerable version, and while publicly available exploit code exists, EPSS is low (0.23%, 14th percentile) and there is no indication of confirmed active exploitation in CISA KEV.
Arbitrary file upload with remote code execution impact in the WordPress plugin WP Import Export Lite affects every version before 3.9.33, allowing an authenticated user who holds the plugin's import permission to make the server fetch a remote file of the attacker's choosing and store it without any validation of type, extension, or content. The plugin's URL-based import path performs no content checks, so executable files can be planted on the host and executed; the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) confirms the low-privileged-but-authenticated prerequisite and no victim interaction. Publicly available exploit code exists, though EPSS is currently low at 0.25% (17th percentile), reflecting the limited population of sites that both run the plugin and expose the import capability; a vendor fix is available in 3.9.33. This is a genuine priority for any site running WP Import Export Lite before 3.9.33, tempered by an authentication prerequisite.
Unrestricted PHP function invocation in the WP Import Export Lite WordPress plugin before 3.9.33 allows a user holding the plugin's export permission to achieve remote code execution by applying arbitrary PHP functions to exported field values they control. Exploitation requires an authenticated, high-privilege account (PR:H in the assessed CVSS vector) that can configure and run an export, needs no user interaction, and is network-reachable. Publicly available exploit code exists, though EPSS is low at 0.27% (20th percentile) and there is no CISA KEV listing; the vendor has released a fix in version 3.9.33.
Remote code execution in the WP Import Export Lite WordPress plugin before 3.9.34 requires an authenticated user who has been granted the plugin's export permission, a privileged, non-default capability typically held by administrators or trusted operators. The plugin does not validate the user-supplied output path or filename when its export routine writes files, so that user can write a file with an arbitrary name - for example a .php webshell - into an arbitrary web-accessible directory and have it executed with the web server's privileges. Publicly available exploit code exists, but the flaw is not listed in CISA KEV, there is no confirmed active exploitation, and EPSS is low at 0.27% (20th percentile); the vendor has released 3.9.34 as the fix.
Broken access control in the MultiVendorX WordPress plugin (versions 5.0.0 through 5.0.15) allows any authenticated user, including a subscriber with no vendor privileges, to overwrite arbitrary stores' details and payout settings and to reassign a store's ownership record through a REST API route that fails to verify the caller owns the target store. Publicly available exploit code exists and the vendor has released a fixed version (5.0.16), so the primary exposure window is sites that have not yet updated; CISA KEV does not list this issue and the EPSS score is low (0.17%, 7th percentile), indicating speculative rather than mass-exploitation risk. The practical impact is high where open user registration is enabled, because a freshly created subscriber account is sufficient to tamper with merchant payout configuration and store ownership, and exploitation requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to and including 3.8.9, allowing an attacker to inject arbitrary JavaScript through the plugin's AJAX cron handler request parameter because input is not sanitized and output is not escaped. The injected payload is persisted and executes in the browser of any user — including administrators — who later views the affected page, enabling session theft, credential harvesting, or full site takeover via an admin session. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated network-reachable attack path makes it a realistic target for automated scanning; an upstream fix was committed in WordPress.org plugin changeset 3638342.
Arbitrary file overwrite in the Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) affects all versions up to and including 32.0.1, where the 'baseUrlForFacebook' parameter is passed to a file-writing routine without adequate path validation. Exploitation requires at least a subscriber-level account on the target WordPress site, but then allows overwriting known files on the server, which can escalate to remote code execution when the overwritten path is a PHP file that the web server later executes. No public exploit code or CISA KEV listing was provided in the source data for this CVE, so active exploitation is unconfirmed at time of analysis.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in the YayPricing WordPress plugin before 3.5.7 lets any authenticated subscriber-role user inject arbitrary JavaScript into the plugin's pricing rules via an unprotected REST API endpoint that lacks authorization checks. The payload persists server-side and executes in the browser of any WordPress administrator who subsequently opens the YayPricing settings page, enabling session hijacking or full administrative account takeover. No public exploit code has been identified at time of analysis, and the vendor-released fix is available in version 3.5.7.
Unauthenticated credential token disclosure in the Zonify WordPress plugin before 1.0.5 exposes the site's stored service account login token to any remote attacker without authentication. The plugin fails to perform any WordPress capability check or authentication verification before returning the stored token, allowing retrieval by any network-reachable actor. An attacker who obtains the token can then authenticate to the site owner's linked third-party service account, effectively achieving full account takeover of the integrated service. No public exploit code has been identified at time of analysis, and EPSS stands at 0.18%, but the zero-barrier exploitation profile - unauthenticated, low complexity, network-accessible - makes the vulnerability trivial to abuse once discovered.
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.
PHP Object Injection in the wpstorecart WordPress plugin (through 5.0.7) exposes an unauthenticated deserialization endpoint bundled as an add-on, permitting attackers to inject arbitrary PHP objects without class restrictions. Exploitation to full system compromise (RCE) is contingent on the presence of a suitable POP gadget chain elsewhere in the WordPress environment - a condition that is common on complex WordPress installations running multiple plugins. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting low current exploitation activity.
Unauthenticated SQL injection in the Album Cover Finder WordPress plugin (≤0.7.0) exposes database contents to remote attackers without any credentials. The CVSS S:C vector indicates the injection can reach data beyond the plugin's own scope - most critically, WordPress core tables containing hashed admin passwords and user data. No public exploit code has been identified and EPSS sits at 0.18% (7th percentile), suggesting low observed exploitation activity despite the severity score; no vendor-released patch has been confirmed at time of analysis.
Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.
Unauthenticated stored XSS with missing authorization controls in the BE REST Endpoints WordPress plugin (≤1.0.0) enables persistent script injection across all pages rendering affected widgets. The plugin exposes widget management REST endpoints with no authorization enforcement whatsoever, allowing any unauthenticated network caller to create, update, or delete widgets while injecting arbitrary JavaScript that is stored without sanitization. Every subsequent visitor - including administrators - who loads a page rendering those widgets will execute the injected payload in their browser, making session-theft and site takeover realistic downstream impacts.
Stored Cross-Site Scripting in the Export & Import WPBakery Page Builder WordPress plugin (through 1.0.2) is achievable by any remote attacker who can lure a logged-in administrator into visiting a forged page. The plugin's template-import endpoint lacks CSRF protection and fails to sanitize imported template data before persisting and reflecting it, meaning a crafted template injected via a forged POST request stores malicious JavaScript that executes in the administrator's browser session. No public exploit is identified at time of analysis, and EPSS sits at 0.11%, suggesting limited opportunistic targeting.
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.
Remote code execution against WordPress sites is achievable through the Gpx2Graphics plugin (through version 0.3) by exploiting a missing CSRF token check and absent file-type validation on the plugin's upload handler. An unauthenticated attacker who tricks a logged-in WordPress administrator into visiting a crafted web page can silently deposit an arbitrary PHP webshell in a web-accessible directory, then invoke it to execute OS commands under the web server's identity. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low current mass-exploitation probability.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Unauthenticated SQL injection in the SAMO Forms WordPress plugin (≤1.0.0) allows remote attackers to query the underlying database without any credentials. Multiple plugin endpoints fail to sanitize or escape user-supplied input before incorporating it into SQL queries, enabling classic and potentially blind SQLi attacks. No public exploit code has been identified at time of analysis, and EPSS sits at 0.19% (9th percentile), suggesting no observed widespread exploitation despite the low attack complexity.
Privilege escalation in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8) allows a site-level administrator on a WordPress multisite network to elevate their own account or grant a newly provisioned temporary login to network super admin status. The missing authorization check in the account-provisioning and account-promotion logic completely bypasses the multisite privilege boundary, enabling a subordinate site admin to seize control of the entire WordPress network without any additional user interaction. Vendor-released patch is available in version 1.9.9; no public exploit identified at time of analysis, and EPSS is low at 0.14%.
Privilege escalation via IDOR in the Amelia 'Booking for Appointments and Events Calendar' WordPress plugin before 2.4.10 allows users holding plugin-level customer or employee management permissions to overwrite the email address and password of any linked WordPress account, achieving full account takeover of other users including administrators. The flaw stems from missing entitlement verification when editing customer or employee records: the plugin confirms the actor holds management rights within Amelia but never confirms ownership of the underlying WordPress account being modified. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.14% (4th percentile). A vendor-released patch exists at version 2.4.10.
Arbitrary file deletion in the WebTotem Backups WordPress plugin (through version 1.0.1) allows any authenticated low-privilege user, including a subscriber, to delete arbitrary files on the server. The plugin fails on three fronts at once: it does not validate the user-supplied file path, performs no capability check on the requester, and discards the outcome of its own CSRF nonce check. Deleting critical files such as wp-config.php can trigger a full site takeover. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw was reported by WPScan.
Arbitrary file deletion in the CODE MONKEYS PROPOSALS WordPress plugin (all versions through 1.0.1) allows any authenticated user - including a low-privileged subscriber - to delete arbitrary files on the server, because the plugin neither validates the user-supplied file path nor checks the caller's capability. Deleting critical files such as wp-config.php can force WordPress into a reinstallation state, enabling full site takeover. Reported by WPScan; publicly available exploit code exists via the WPScan advisory, though EPSS remains low at 0.15% (4th percentile) and it is not listed in CISA KEV.
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
SQL injection in the MC Woocommerce Wishlist WordPress plugin (versions up to and including 1.9.21) allows an authenticated administrator to inject arbitrary SQL through admin-facing input, potentially exposing sensitive database contents. Although rated high on CVSS, the flaw requires an existing administrator account, so realistic risk is limited to attackers who already hold admin rights; no public exploit has been identified and there is no evidence of confirmed active exploitation per CISA KEV.
SQL injection in PublishPress Series (also distributed as Organize Series) 3.1.3 and earlier lets an authenticated WordPress Administrator run arbitrary SQL through the plugin's admin-side functionality, allowing read access to the WordPress database and limited modification of its contents. Exploitation requires a logged-in account with Administrator privileges (PR:H), needs no user interaction (UI:N), and no public exploit code was identified at the time of analysis. Because a WordPress Administrator already holds broad database and site control, the practical incremental risk is low even though the CVSS base score is high.
SQL injection in WP-Lister Lite for eBay 3.8.11 and earlier allows an authenticated user holding the WooCommerce 'Shop manager' role to inject arbitrary SQL into queries executed by the plugin, exposing database contents such as WordPress user hashes, order records, and customer personally identifiable information. The issue is remote, low complexity, and requires no user interaction, but the PR:H prerequisite narrows the practical attacker pool to insiders or actors who have already compromised a Shop-manager account, which is why the independent assessment places it in the mid-to-high band rather than an emergency tier. No vendor-released patch has been identified at time of analysis, and no public exploit identified at time of analysis; EPSS data was not supplied.
SQL injection in the SKT Addons for Elementor WordPress plugin (version 4.0 and earlier) allows an attacker who already holds a high-privilege authenticated WordPress account - PR:H in the vector, typically an Editor or Administrator able to reach the plugin's Elementor editor functionality - to inject arbitrary SQL against the site's backend database over the network with low attack complexity and no user interaction. The vendor-assigned CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment rates the same vector at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N, i.e. confidentiality-heavy database disclosure rather than a scope-changing, integrity-destroying primitive. Because exploitation is gated behind the PR:H requirement, risk is concentrated in insider misuse or in an attacker who has already chained a separate privilege compromise; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for this CVE.
SQL injection in the WC Vendors Marketplace WordPress plugin (versions up to and including 2.7.2.1) allows an authenticated WordPress administrator to inject arbitrary SQL through an admin-side marketplace parameter, putting the site's database contents at risk of disclosure. The administrator-level privilege gate (PR:H) is the dominant limiting factor: administrator accounts already hold full database and code-execution capability, so the realistic exposure is largely insider misuse or reuse of a hijacked admin session rather than attacker escalation from a low-privileged user. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is tracked as EUVD-2026-81507 following disclosure by Patchstack.
SQL injection in the WordPress plugin WPMasterToolKit affects versions 2.22.0 and earlier, allowing an attacker who already holds a WordPress Administrator session to inject arbitrary SQL through affected plugin functionality and read data from the underlying database. Exploitation requires the highest standard WordPress privilege level (PR:H per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and the assessed impact is confidentiality-only - no integrity or availability effect was confirmed - while the vulnerability has no public exploit identified at time of analysis and is not listed as confirmed actively exploited (CISA KEV). Because the required Administrator role already has broad legitimate database and site access in WordPress, this is best characterized as a high-CVSS-but-low-real-priority finding whose practical value is largely limited to insider abuse or post-compromise escalation, with no vendor-released fixed version identified at time of analysis.
SQL injection in the Tribulant Newsletters WordPress plugin (versions 4.18 and earlier) allows authenticated administrators to execute arbitrary SQL queries, leading to high-impact confidentiality breaches and low-impact integrity tampering within the WordPress database. The flaw requires an Administrator-level account (PR:H) and is remotely exploitable without user interaction, but no public exploit code has been identified at time of analysis. Our independent assessment rates this as a high-privilege, low-real-world-priority issue despite its 7.6 CVSS, because administrators can already edit plugin code and query the database directly.
SQL injection in the WP Maps WordPress plugin (Flipper Code) through version 4.9.9 lets an attacker who already holds a WordPress Administrator session inject arbitrary SQL through an admin-side parameter, exposing database contents. The vulnerable code path is administrator-only (CVSS PR:H), so the flaw cannot be triggered by unauthenticated or low-privilege users, and no public exploit code has been identified at time of analysis; reported by Patchstack (ENISA EUVD-2026-81504). This is a high-CVSS (7.6) but comparatively low real-world-priority issue once the highest-privilege prerequisite is weighed.
Authenticated SQL injection in the Rextheme Product Feed Manager WordPress plugin (slug best-woocommerce-feed) affects all versions up to and including 7.12.0 and lets an attacker with at least Contributor-level access on the site inject arbitrary SQL through the plugin's query handling. The reported CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), with the assessed vector refining this to AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so the dominant impact is high-confidentiality database disclosure rather than full site takeover. Exploitation requires a low-privileged authenticated account, which makes the risk significantly higher on sites with open registration or broadly granted Contributor/Author roles and much lower on single-admin sites; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site request forgery in the WordPress plugin Asset CleanUp: Page Speed Booster (versions up to and including 1.4.0.5) lets a remote attacker forge requests that a logged-in privileged user, typically an administrator working in the plugin's settings, unknowingly submits to the site. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) the attacker needs no credentials of their own, but a successful attack depends entirely on socially engineering an existing authenticated victim into visiting an attacker-controlled page while their WordPress session is active; there is no authentication bypass and only limited integrity impact is assessed. No public exploit code, and no confirmed active exploitation (CISA KEV), were identified at time of analysis, so this is a moderate, not top-tier, priority, reported to the vendor by Patchstack. Note that the vendor-supplied CVSS 7.1 rating is higher than the independent assessment because it assumes changed scope and low-level confidentiality and availability impact that are not supported by the described attack path.
Unauthenticated attackers can bypass the authentication logic of the miniOrange Headless Single Sign On WordPress plugin at versions up to and including 1.7.0, gaining access as arbitrary users - potentially administrators - with full confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no credentials, no user interaction, and no client-side prerequisites against an affected installation; the practical limiting factor is deployment, since this is a niche headless-SSO component with a modest install footprint, and the precise configuration state that triggers the bypass is not described in the advisory. At time of analysis there is no CISA KEV entry and no public exploit identified, so the risk is driven by the severity of the flaw and the ease of the network attack path rather than by observed exploitation. Reported by Patchstack (EUVD-2026-81491).
Unauthenticated remote code execution in Migratico Lite, a WordPress site-migration plugin, affects all versions up to and including 2.6.8 and lets a remote attacker who can reach an affected site inject and execute arbitrary code with the privileges of the web server. The vendor-disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, reported by Patchstack) requires no authentication and no user interaction, so any WordPress installation running an affected plugin version is potentially exposed; our independent assessment keeps the same network/authentication profile but scores scope as unchanged (S:U), giving an effective base score of 9.8. Exploitation is tempered by practical limits: Migratico Lite is a niche migration plugin with a modest install base, and the sparse public advisory does not disclose the vulnerable endpoint or parameter, so no public exploit code has been identified at time of analysis and weaponization currently depends on an attacker locating the injection sink themselves. There is no CISA KEV entry for this CVE.
Authentication bypass in the EduAdmin Booking WordPress plugin (all versions up to and including 5.4.2) lets an unauthenticated remote visitor reach functionality that should require a logged-in, privileged user. Patchstack rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assigned weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel); our assessment concurs on the unauthenticated, no-interaction, remotely reachable nature of the flaw but scores availability as not impacted (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), so the practical consequence is high-impact disclosure and data manipulation rather than denial of service. No entry appears in CISA KEV and no public exploit code was identified at time of analysis, so exposure is currently driven by whether the plugin is installed and network-reachable rather than by active exploitation.
Unauthenticated cross-site scripting in Visitor Traffic Real Time Statistics Pro (versions up to and including 11.21) lets any anonymous internet user craft a request or link whose payload is reflected or stored by the plugin and then executed in a victim's browser. Because the CVSS vector requires user interaction (UI:R), the attacker cannot trigger the payload without a victim rendering it, and the impact is greatest when that victim is a logged-in WordPress administrator, where script execution can lead to session hijack, credential theft, or forged admin actions. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the plugin's unauthenticated attack surface and the very broad install base of WordPress make opportunistic scanning plausible.
Unauthenticated SQL injection in the Yo WordPress plugin versions 1.1 through 1.3.1 allows remote attackers to read arbitrary database contents, including administrator password hashes. The flaw occurs because the plugin uses the username request parameter in a SQL query before WordPress applies its request escaping, so no authentication or user interaction is required. Publicly available exploit code exists, and while no confirmed active exploitation (CISA KEV) is reported, the high confidentiality impact makes this a priority for sites running the affected plugin.
Unauthenticated file upload in the To Do List Member WordPress plugin (versions 1.4 through 1.6) lets any remote attacker stage attacker-controlled files - including active content such as PHP payloads served from the site's own origin - and also enumerate and delete files already staged there. The plugin ships a standalone upload endpoint that never bootstraps WordPress, so no authentication, capability, or nonce check is ever performed, and only the uploaded filename is validated rather than the file's contents. Publicly available exploit code exists (reported by WPScan), and our assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact - no victim interaction is required, contrary to the vendor vector's UI:R - with the practical limit on real-world risk being the plugin's niche deployment footprint plus any WAF or perimeter rule that blocks direct requests to the endpoint or PHP execution in the upload directory.
Reflected cross-site scripting in the Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before version 5.4.2 allows an unauthenticated attacker to inject arbitrary script into a page that is echoed back to the victim's browser, enabling session theft, credential harvesting, or malicious redirects in the context of the targeted site. Exploitation is not autonomous: the attacker must craft a link containing the payload in one of the plugin's unsanitised parameters and socially engineer a visitor - or an authenticated administrator, which materially raises the stakes - into following it, so the assessed vector requires user interaction (UI:R) and impact is confined to the victim's browser session rather than the server. Publicly available exploit code exists per the WPScan report, but there is no KEV listing indicating confirmed active exploitation; the issue is a real but moderate-priority reflected XSS in a niche WordPress plugin, with a vendor-released fix at version 5.4.2.
Privilege escalation in the PuppyFW WordPress plugin (all versions through 0.4.4) lets any authenticated user, down to a Subscriber, add, modify, and delete arbitrary blog options, which is enough to grant themselves administrative capabilities. The root cause is a REST route that performs its capability check against a capability value supplied in the request itself, so the caller effectively authorizes itself; no user interaction and no special plugin configuration are required. Publicly available exploit code exists, so sites that allow open self-registration are directly at risk, and this is a genuine high-priority issue rather than a theoretical one.
Unauthenticated remote code execution in the wpShopGermany IT-RECHT KANZLEI WordPress plugin affects every release from 1.6 up to but not including 2.4. The plugin builds its API authentication token from data the requester supplies and creates that token as a side effect of the routine that is supposed to validate it, so an attacker can compute a valid token without any credentials and use the access it grants to write arbitrary files on the server, which in a PHP/WordPress context converts directly into code execution. No authentication or user interaction is required - only network reachability to the plugin's token-authenticated API endpoint - and publicly available exploit code exists (the finding was published by WPScan). Our independent assessment rates the realistic vector as AC:L/PR:N/UI:N/S:U with high confidentiality, integrity and availability impact, a step more severe than the vendor's 9.0 AC:H/S:C rating; the practical brake on this issue is deployment scope, since this is a niche legal-compliance plugin rather than a mass-market component.
Stored cross-site scripting in the Dictionary WordPress plugin (all versions through 1.0) allows unauthenticated attackers to inject arbitrary web scripts into dictionary entries, which then execute in the browser of any user who views the poisoned entry. The add/update entry functionality is implemented with no authorization check, no input sanitization, and no output escaping, and publicly available exploit code exists (reported by WPScan); there is no CISA KEV listing, so active exploitation is not confirmed. Although the headline CVSS score is 8.8, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, placing real-world risk below the vendor score because the payload only fires when a victim views the affected entry and meaningful escalation (session/nonce theft, account takeover) requires that viewer to be an authenticated, privileged user.
Stored cross-site scripting in the Dewa Kirim WordPress plugin through 1.0.0 allows an unauthenticated visitor to inject JavaScript through the delivery-coordinates field submitted during checkout, which is then written unescaped into an inline script and executes in the browser session of any administrator who later opens the affected order in wp-admin. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.8) reflects that no authentication or special server configuration is required and the only friction is the user-interaction requirement: an admin must view the poisoned order for the payload to fire, after which a compromised admin session can lead to full site takeover. Publicly available exploit code exists, and although EPSS and KEV data were not provided, this is a credible high-priority issue within its niche install base given the unauthenticated injection path and the privileged target context.
Unauthenticated attackers can log in as any user, including administrators, in the WordPress plugin Login with QR through version 1.0.0 because it fails to verify that the QR login code was issued by the plugin, instead matching any stored user metadata value. This critical authentication bypass (CVSS 9.8) requires no authentication or user interaction and is remotely exploitable against default configurations, with publicly available exploit code but no confirmation of active exploitation in the wild. The plugin must be installed and active for exploitation, but its niche deployment footprint is the only limiting factor.
Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. The primary limiting factor is the plugin's low deployment footprint, but where present, it is a top-priority risk.
Unauthenticated attackers can log in as any WordPress user, including administrators, on sites running the Private Feed Key plugin at version 0.1 or below, because the plugin's feed-authentication check accepts any value already stored in a user's metadata instead of verifying a key that the plugin itself issued. The issue is network-reachable with no authentication or user interaction required (CVSS 3.1 9.8, CWE-287, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists; no CISA KEV listing is indicated in the available intelligence supplied for this analysis. Exposure hinges solely on whether this obscure plugin is installed and active - no non-default configuration, special platform, or privileged position is needed - which is why the independent assessment rates it a genuine top-priority vulnerability rather than a high-score-but-low-risk case.
Unauthenticated stored/reflected cross-site scripting (CWE-79) in the WordPress plugin WPLP Cookie Consent before 4.4.4 allows a remote attacker to run arbitrary JavaScript in an administrator's session by submitting a crafted value to a public endpoint that the plugin later renders, unescaped, into a JavaScript context on an administrative screen; the injection itself requires no authentication (PR:N) but execution depends on an administrator interacting with the affected admin page (UI:R), and only multisite installations are affected. Publicly available exploit code exists, which lowers the effort needed to reproduce and weaponize the payload, though no confirmed active exploitation (CISA KEV) is recorded. The vendor has released a fix in version 4.4.4, so the realistic risk is concentrated on unpatched multisite deployments where admins routinely open the affected screen.
Privilege escalation in the WordPress plugin "Choose User Role at Registration" before 1.3.3 lets an unauthenticated visitor submit a registration request naming any role - including administrator - because the plugin never validates the requested role against the roles the administrator actually configured to be offered; once the pending request is approved, the attacker receives that elevated role. Exploitation requires both non-default features to be enabled (role selection at registration and public/open account registration), and the escalation only completes after a human administrator approves the account, which is why the assessed vector carries AC:H and UI:R despite the network-delivered, unauthenticated (PR:N) request. Publicly available exploit code exists and the vendor has released a patched version, but no confirmed active exploitation (CISA KEV) is associated with this CVE at time of analysis.
Reflected cross-site scripting in the Dictionary WordPress plugin, affecting all versions up to and including 1.0, lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Attackers must induce a victim to submit a crafted request to one of the plugin's several directly accessible scripts (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1), and publicly available exploit code exists, though there is no confirmed evidence of active exploitation in the wild. The threat is moderate and bounded: the primary limiting factor is the required user interaction, so delivery is per-target via phishing or a malicious link rather than mass, self-propagating compromise, and impact is confined to the victim's browser rather than the server.
Unauthenticated arbitrary file upload in the Multi Uploader for Gravity Forms WordPress plugin (all versions up to and including 1.1.9) lets attackers write executable files to the affected site's server through the move_file() chunked-upload handler, which applies insufficient file-type validation, making remote code execution possible. Exploitation requires the plugin to be installed and active alongside the commercial Gravity Forms plugin and a publicly reachable form that exposes a multi-uploader field; the CVSS vector (PR:N/UI:N) confirms no authentication or victim interaction is needed, though RCE additionally depends on the uploaded file landing in a web-executable location. Risk is rated high-priority (CVSS 9.8), with the practical exposure narrowed by the plugin's niche deployment and its Gravity Forms dependency; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis.
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the LearnPress WordPress plugin before 4.4.7 allows unauthenticated attackers to inject arbitrary JavaScript into a public page by luring a victim to a crafted link, with the script executing in the victim's browser under the site's origin. Because the payload lands in an unescaped HTML attribute, a logged-in administrator who opens the link can be made to run attacker-controlled code with their privileges (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), though exploitation is contingent on victim interaction and on the site using a classic (non-block) theme. Public exploit code is available and WPScan has published an advisory, but EPSS is low at 0.22% (13th percentile) and the supplied intelligence contains no CISA KEV entry indicating confirmed active exploitation; the vendor has addressed the issue in version 4.4.7.
Privilege escalation in the Tutor LMS WordPress plugin (versions 2.7.1 up to but not including 4.0.8) lets the holder of a read-only Tutor LMS REST API key act with the full privileges of the administrator account that issued that key, producing high confidentiality, integrity and availability impact and, in practice, complete takeover of the affected WordPress site. Exploitation is authenticated in the sense that the attacker must already hold a valid API credential provisioned by a site administrator - obtained through grant, leak, or capture - after which no further user interaction is required; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.2 as published with PR:H). Publicly available exploit code exists and WPScan has published the vulnerability record, but there is no indication of confirmed active exploitation (not in CISA KEV); EPSS is low at 0.17% (7th percentile), suggesting limited observed exploitation activity despite the severity of impact once a key is held.
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Stored cross-site scripting in the Optimole WordPress plugin versions 4.2.3 through 4.2.11 allows unauthenticated attackers to inject arbitrary attributes into an image tag built from an unescaped user-supplied value, with the poisoned markup then served to every visitor of the affected site. Exploitation is unauthenticated (PR:N) but requires a victim to load the page containing the injected attribute (UI:R); because the malicious content is persisted server-side, any visitor or administrator viewing that page can trigger execution. A patch is available in Optimole 4.2.12 and publicly available exploit code exists, though EPSS is low at 0.22% (13th percentile), indicating limited observed exploitation pressure at the time of analysis.
Unauthenticated SQL injection in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 lets any remote visitor inject arbitrary SQL into a query built from an unsanitised, unescaped parameter, potentially exposing the site's backend database contents. The flaw is trivially reachable - our assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N, meaning no credentials, no user interaction, and no non-default configuration are required, with impact scored to confidentiality (C:H) only. Exploitation is bounded by the fact that the target must be a WordPress site running this specific, relatively niche plugin at a vulnerable version, and while publicly available exploit code exists, EPSS is low (0.23%, 14th percentile) and there is no indication of confirmed active exploitation in CISA KEV.
Arbitrary file upload with remote code execution impact in the WordPress plugin WP Import Export Lite affects every version before 3.9.33, allowing an authenticated user who holds the plugin's import permission to make the server fetch a remote file of the attacker's choosing and store it without any validation of type, extension, or content. The plugin's URL-based import path performs no content checks, so executable files can be planted on the host and executed; the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) confirms the low-privileged-but-authenticated prerequisite and no victim interaction. Publicly available exploit code exists, though EPSS is currently low at 0.25% (17th percentile), reflecting the limited population of sites that both run the plugin and expose the import capability; a vendor fix is available in 3.9.33. This is a genuine priority for any site running WP Import Export Lite before 3.9.33, tempered by an authentication prerequisite.
Unrestricted PHP function invocation in the WP Import Export Lite WordPress plugin before 3.9.33 allows a user holding the plugin's export permission to achieve remote code execution by applying arbitrary PHP functions to exported field values they control. Exploitation requires an authenticated, high-privilege account (PR:H in the assessed CVSS vector) that can configure and run an export, needs no user interaction, and is network-reachable. Publicly available exploit code exists, though EPSS is low at 0.27% (20th percentile) and there is no CISA KEV listing; the vendor has released a fix in version 3.9.33.
Remote code execution in the WP Import Export Lite WordPress plugin before 3.9.34 requires an authenticated user who has been granted the plugin's export permission, a privileged, non-default capability typically held by administrators or trusted operators. The plugin does not validate the user-supplied output path or filename when its export routine writes files, so that user can write a file with an arbitrary name - for example a .php webshell - into an arbitrary web-accessible directory and have it executed with the web server's privileges. Publicly available exploit code exists, but the flaw is not listed in CISA KEV, there is no confirmed active exploitation, and EPSS is low at 0.27% (20th percentile); the vendor has released 3.9.34 as the fix.
Broken access control in the MultiVendorX WordPress plugin (versions 5.0.0 through 5.0.15) allows any authenticated user, including a subscriber with no vendor privileges, to overwrite arbitrary stores' details and payout settings and to reassign a store's ownership record through a REST API route that fails to verify the caller owns the target store. Publicly available exploit code exists and the vendor has released a fixed version (5.0.16), so the primary exposure window is sites that have not yet updated; CISA KEV does not list this issue and the EPSS score is low (0.17%, 7th percentile), indicating speculative rather than mass-exploitation risk. The practical impact is high where open user registration is enabled, because a freshly created subscriber account is sufficient to tamper with merchant payout configuration and store ownership, and exploitation requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to and including 3.8.9, allowing an attacker to inject arbitrary JavaScript through the plugin's AJAX cron handler request parameter because input is not sanitized and output is not escaped. The injected payload is persisted and executes in the browser of any user — including administrators — who later views the affected page, enabling session theft, credential harvesting, or full site takeover via an admin session. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated network-reachable attack path makes it a realistic target for automated scanning; an upstream fix was committed in WordPress.org plugin changeset 3638342.
Arbitrary file overwrite in the Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) affects all versions up to and including 32.0.1, where the 'baseUrlForFacebook' parameter is passed to a file-writing routine without adequate path validation. Exploitation requires at least a subscriber-level account on the target WordPress site, but then allows overwriting known files on the server, which can escalate to remote code execution when the overwritten path is a PHP file that the web server later executes. No public exploit code or CISA KEV listing was provided in the source data for this CVE, so active exploitation is unconfirmed at time of analysis.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Authenticated privilege escalation in the Consulting WordPress theme (versions up to and including 6.7.16) lets any subscriber-level user take over a site as administrator by chaining two coding flaws. The theme's masterstudy_ms_stm_set_discard_transient AJAX action writes an attacker-chosen transient value without any capability check or nonce, and the theme's "developer access" login path trusts a transient value in legacy string mode, so an attacker can seed a known token and then log in as any existing account, including an admin. The CVSS score is 8.8 (network, low privileges, no user interaction, full confidentiality/integrity/availability impact); no EPSS score, KEV listing, or public exploit code was provided at time of analysis.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Missing authorization controls in the ThemeAtelier Domain For Sale WordPress plugin before 3.5.2 expose unauthenticated REST API endpoints that disclose sensitive business data and permit destructive operations. Remote unauthenticated attackers can enumerate all stored offer records, harvest bidder contact information, verification tokens, and messages, and delete arbitrary offers by iterating numeric identifiers. No public exploit is identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning and exploitation across WordPress installations is technically feasible.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
Unauthenticated stored XSS in the YouTube Embed WordPress plugin (versions 10.0-10.3) allows any unauthenticated site visitor to inject and persist arbitrary JavaScript in the WordPress database by exploiting an AJAX endpoint that performs no authorization check beyond a nonce embedded in every public-facing page. The stored payload executes in the browser session of any subsequent visitor or administrator who views the affected content, enabling session hijacking, administrative account takeover, or full site compromise. A publicly available exploit exists (reported by WPScan), materially elevating real-world risk for any site running the affected plugin versions.
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Missing authorization on an AJAX endpoint in the CryptoPayment Gateway WordPress plugin (versions 1.2.1 through 1.2.2) lets remote unauthenticated attackers invoke administrative operations. An attacker can delete arbitrary files on the server, overwrite the payment gateway configuration, and read stored wallet credentials in cleartext. Publicly available exploit detail exists (reported by WPScan); there is no public evidence of active exploitation at time of analysis, though the CVSS vector (10.0, AV:N/AC:L/PR:N/UI:N/S:C) marks it as trivially exploitable.
The GenieWords WordPress plugin versions 1.5.27 through 1.5.34 allows unauthenticated attackers to overwrite plugin configuration via unprotected REST API and AJAX endpoints, then achieves persistent stored XSS on every front-end page because stored values are decoded and printed without sanitization. Any site visitor who loads a front-end page becomes an XSS victim, enabling session hijacking, credential theft, or malicious redirects at scale. A publicly available exploit exists (WPScan); no active exploitation is confirmed in CISA KEV at the time of analysis, but the unauthenticated attack path and low complexity make opportunistic mass-scanning feasible.
Two-factor authentication bypass in the Really Simple Security WordPress plugin (versions before 9.8.1) allows an attacker who already holds a target account's password to eliminate that account's email 2FA requirement entirely and obtain the resulting session, up to administrator level. The root flaw is an unauthenticated endpoint that resets a completed email 2FA enrollment, collapsing multi-factor authentication to single-factor for the attack window. A publicly available exploit has been published via WPScan, and the vendor has released a fix in version 9.8.1.
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows any subscriber-level authenticated user to be granted the WordPress role attached to a paid membership plan without completing payment, by exploiting a missing capability check and absent payment method and plan validation on the purchase endpoint. Where site administrators have configured membership plans mapped to privileged WordPress roles - including administrator - this results in full privilege escalation from subscriber to administrator without financial transaction. A publicly available proof-of-concept exploit from WPScan confirms the attack path is well-documented and reproducible against sites with open user registration.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user holding an Author-level role or above to assign themselves an arbitrary WordPress role, including Administrator, resulting in full site takeover. The plugin fails to enforce server-side authorization checks when creating membership plans and when users attach plans to their own accounts, permitting role manipulation that bypasses WordPress's native access-control hierarchy. A publicly available exploit exists via WPScan, and the CVSS 7.2 score understates real-world risk because the provided PR:H metric conflicts with the description's requirement of only Author-level access - a low-privilege role - suggesting a closer real-world base score of approximately 8.8.
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in the YayPricing WordPress plugin before 3.5.7 lets any authenticated subscriber-role user inject arbitrary JavaScript into the plugin's pricing rules via an unprotected REST API endpoint that lacks authorization checks. The payload persists server-side and executes in the browser of any WordPress administrator who subsequently opens the YayPricing settings page, enabling session hijacking or full administrative account takeover. No public exploit code has been identified at time of analysis, and the vendor-released fix is available in version 3.5.7.
Unauthenticated credential token disclosure in the Zonify WordPress plugin before 1.0.5 exposes the site's stored service account login token to any remote attacker without authentication. The plugin fails to perform any WordPress capability check or authentication verification before returning the stored token, allowing retrieval by any network-reachable actor. An attacker who obtains the token can then authenticate to the site owner's linked third-party service account, effectively achieving full account takeover of the integrated service. No public exploit code has been identified at time of analysis, and EPSS stands at 0.18%, but the zero-barrier exploitation profile - unauthenticated, low complexity, network-accessible - makes the vulnerability trivial to abuse once discovered.
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.
PHP Object Injection in the wpstorecart WordPress plugin (through 5.0.7) exposes an unauthenticated deserialization endpoint bundled as an add-on, permitting attackers to inject arbitrary PHP objects without class restrictions. Exploitation to full system compromise (RCE) is contingent on the presence of a suitable POP gadget chain elsewhere in the WordPress environment - a condition that is common on complex WordPress installations running multiple plugins. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting low current exploitation activity.
Unauthenticated SQL injection in the Album Cover Finder WordPress plugin (≤0.7.0) exposes database contents to remote attackers without any credentials. The CVSS S:C vector indicates the injection can reach data beyond the plugin's own scope - most critically, WordPress core tables containing hashed admin passwords and user data. No public exploit code has been identified and EPSS sits at 0.18% (7th percentile), suggesting low observed exploitation activity despite the severity score; no vendor-released patch has been confirmed at time of analysis.
Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.
Unauthenticated stored XSS with missing authorization controls in the BE REST Endpoints WordPress plugin (≤1.0.0) enables persistent script injection across all pages rendering affected widgets. The plugin exposes widget management REST endpoints with no authorization enforcement whatsoever, allowing any unauthenticated network caller to create, update, or delete widgets while injecting arbitrary JavaScript that is stored without sanitization. Every subsequent visitor - including administrators - who loads a page rendering those widgets will execute the injected payload in their browser, making session-theft and site takeover realistic downstream impacts.
Stored Cross-Site Scripting in the Export & Import WPBakery Page Builder WordPress plugin (through 1.0.2) is achievable by any remote attacker who can lure a logged-in administrator into visiting a forged page. The plugin's template-import endpoint lacks CSRF protection and fails to sanitize imported template data before persisting and reflecting it, meaning a crafted template injected via a forged POST request stores malicious JavaScript that executes in the administrator's browser session. No public exploit is identified at time of analysis, and EPSS sits at 0.11%, suggesting limited opportunistic targeting.
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.
Remote code execution against WordPress sites is achievable through the Gpx2Graphics plugin (through version 0.3) by exploiting a missing CSRF token check and absent file-type validation on the plugin's upload handler. An unauthenticated attacker who tricks a logged-in WordPress administrator into visiting a crafted web page can silently deposit an arbitrary PHP webshell in a web-accessible directory, then invoke it to execute OS commands under the web server's identity. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low current mass-exploitation probability.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Unauthenticated SQL injection in the SAMO Forms WordPress plugin (≤1.0.0) allows remote attackers to query the underlying database without any credentials. Multiple plugin endpoints fail to sanitize or escape user-supplied input before incorporating it into SQL queries, enabling classic and potentially blind SQLi attacks. No public exploit code has been identified at time of analysis, and EPSS sits at 0.19% (9th percentile), suggesting no observed widespread exploitation despite the low attack complexity.
Privilege escalation in the Temporary Login Without Password WordPress plugin (versions 1.5 through 1.9.8) allows a site-level administrator on a WordPress multisite network to elevate their own account or grant a newly provisioned temporary login to network super admin status. The missing authorization check in the account-provisioning and account-promotion logic completely bypasses the multisite privilege boundary, enabling a subordinate site admin to seize control of the entire WordPress network without any additional user interaction. Vendor-released patch is available in version 1.9.9; no public exploit identified at time of analysis, and EPSS is low at 0.14%.
Privilege escalation via IDOR in the Amelia 'Booking for Appointments and Events Calendar' WordPress plugin before 2.4.10 allows users holding plugin-level customer or employee management permissions to overwrite the email address and password of any linked WordPress account, achieving full account takeover of other users including administrators. The flaw stems from missing entitlement verification when editing customer or employee records: the plugin confirms the actor holds management rights within Amelia but never confirms ownership of the underlying WordPress account being modified. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.14% (4th percentile). A vendor-released patch exists at version 2.4.10.
Arbitrary file deletion in the WebTotem Backups WordPress plugin (through version 1.0.1) allows any authenticated low-privilege user, including a subscriber, to delete arbitrary files on the server. The plugin fails on three fronts at once: it does not validate the user-supplied file path, performs no capability check on the requester, and discards the outcome of its own CSRF nonce check. Deleting critical files such as wp-config.php can trigger a full site takeover. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw was reported by WPScan.
Arbitrary file deletion in the CODE MONKEYS PROPOSALS WordPress plugin (all versions through 1.0.1) allows any authenticated user - including a low-privileged subscriber - to delete arbitrary files on the server, because the plugin neither validates the user-supplied file path nor checks the caller's capability. Deleting critical files such as wp-config.php can force WordPress into a reinstallation state, enabling full site takeover. Reported by WPScan; publicly available exploit code exists via the WPScan advisory, though EPSS remains low at 0.15% (4th percentile) and it is not listed in CISA KEV.
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.