WordPress
Monthly
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.
Missing authorization in the WP-Stateless WordPress plugin (versions up to and including 4.4.1) allows authenticated subscriber-level users to modify plugin settings they should have no access to. WP-Stateless manages Google Cloud Storage offloading for WordPress media; unauthorized settings changes by a low-privileged user can corrupt the GCS integration, break media delivery, or reconfigure the storage bucket in ways that degrade site availability. No public exploit code has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. No public exploit or active exploitation has been confirmed at time of analysis.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. No public exploit code has been identified at time of analysis, and Patchstack is the sole reporting source.
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenticated users to obtain gift card coupons worth more than they actually paid at checkout. The plugin issues coupon codes without verifying that the face value matches the payment amount collected by WooCommerce, creating a directly monetizable fraud vector against any store running the affected plugin. A publicly available exploit exists per WPScan, lowering the bar for financial abuse of vulnerable storefronts.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. Reported by Wordfence with a critical 9.8 CVSS; no public exploit is identified at time of analysis, though the trivially scriptable request pattern makes weaponization straightforward.
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.
Missing authorization in the WP-Stateless WordPress plugin (versions up to and including 4.4.1) allows authenticated subscriber-level users to modify plugin settings they should have no access to. WP-Stateless manages Google Cloud Storage offloading for WordPress media; unauthorized settings changes by a low-privileged user can corrupt the GCS integration, break media delivery, or reconfigure the storage bucket in ways that degrade site availability. No public exploit code has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. No public exploit or active exploitation has been confirmed at time of analysis.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Broken access control in Shirt Product Designer for WooCommerce plugin version 1.0.4 exposes WordPress/WooCommerce stores to unauthenticated data modification. The CVSS vector (PR:N, AC:L, AV:N, UI:N) confirms that a remote attacker with no credentials or user interaction can invoke privileged plugin functionality, achieving high integrity impact against store product or configuration data. No public exploit code has been identified at time of analysis, and Patchstack is the sole reporting source.
Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Subscriber-level broken authentication in the MailMunch - Grow your Email List WordPress plugin (versions ≤ 3.2.5) enables low-privileged authenticated users to bypass authentication controls, causing integrity and availability impacts on affected WordPress installations. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, indicating a pathway or channel that circumvents the intended authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis, though the network-accessible, low-complexity attack vector lowers the bar for abuse.
PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.
Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.
Unauthenticated arbitrary WordPress option deletion in the zipMoney (Zip Co) Payments Plugin for WooCommerce before 2.4.0 lets remote attackers destroy site configuration and take the site offline. One front-end request handler performs no authorization checks and does not restrict which option name the caller supplies, so any unauthenticated visitor can delete critical wp_options entries. Publicly available exploit code exists and a vendor patch (2.4.0) is available; no active exploitation has been confirmed (not in CISA KEV).
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Unauthenticated arbitrary site-option deletion in the miniOrange 2FA WordPress plugin (versions 5.3.24 through before 6.3.1, and 18.0 through before 19.3) lets any visitor delete arbitrary wp_options entries because option names are taken directly from request input without validating a legitimate transaction. Deleting the right options can lock every administrator out of the WordPress dashboard or fully deactivate the two-factor plugin, stripping the site of its 2FA protection. Publicly available exploit code exists (WPScan) and a vendor patch is available; the flaw is rated CVSS 10.0.
Unauthenticated information disclosure in Ultimate Gift Cards for WooCommerce (WordPress plugin, versions 3.0.3 through 3.2.9) exposes customer PII, gift card balances, and transaction dates tied to arbitrary orders with no authorization check. Version 3.2.9 raises the severity significantly: the live redemption code is also leaked, allowing any anonymous attacker who retrieves it to spend the gift card balance, crossing from information disclosure into tangible financial fraud. A publicly available proof-of-concept was published by WPScan, and the vulnerability is automatable per CISA SSVC, making mass enumeration of orders and gift card theft realistic.
Price reconciliation failure in the Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 allows unauthenticated users to obtain gift card coupons worth more than they actually paid at checkout. The plugin issues coupon codes without verifying that the face value matches the payment amount collected by WooCommerce, creating a directly monetizable fraud vector against any store running the affected plugin. A publicly available exploit exists per WPScan, lowering the bar for financial abuse of vulnerable storefronts.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, but the unauthenticated network-facing RCE makes this a high-priority patch.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Unauthenticated payment credential hijacking in the Event Tickets and Registration WordPress plugin (StellarWP, all versions ≤5.27.4) allows any remote attacker to silently replace the site's Stripe merchant account credentials - access tokens, publishable keys, and account ID - via a missing capability check on the plugin's Stripe OAuth return endpoint. Once the attacker's own Stripe credentials are stored, all subsequent ticket purchases by legitimate customers are processed into the attacker's account with no visible indication to the buyer or site administrator. No public exploit has been identified at time of analysis, but the fully unauthenticated AV:N/AC:L/PR:N attack surface makes opportunistic mass exploitation straightforward.
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in the Hungarian WooCommerce pickup-points and shipping-labels plugin (versions before 4.2.8) allows unauthenticated remote attackers to perform actions that should be restricted to authorized users, resulting in high-integrity impact against affected WooCommerce stores. The flaw, classified as CWE-862 (Missing Authorization), means the plugin fails to verify whether the requesting party has the right to perform privileged operations - distinct from authentication failure. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. Reported by Wordfence with a critical 9.8 CVSS; no public exploit is identified at time of analysis, though the trivially scriptable request pattern makes weaponization straightforward.
Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.
Privilege escalation in the Abandoned Cart Pro for WooCommerce WordPress plugin (all versions through 10.7.1) allows authenticated subscribers to gain full WordPress administrative access by hijacking the plugin's SMTP email routing. Missing capability checks and nonce verification on at least four AJAX endpoints - including wcap_save_connector_settings - permit any subscriber-level user to silently redirect outbound SMTP traffic through an attacker-controlled mail server. Once SMTP is redirected, the attacker intercepts auto-login recovery links sent to administrators and authenticates as admin without any further credentials. No public exploit has been identified at time of analysis, but the attack exploits a default-enabled feature, significantly lowering the bar for abuse on any standard installation.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.