WordPress
Monthly
Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. No public exploit code or active exploitation has been identified at time of analysis, but the PR:N unauthenticated attack vector means any internet-facing WordPress installation running this plugin version is reachable without attacker credentials.
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Email Essentials WordPress plugin by Acato (all versions through 6.0.6) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack is network-accessible, requires no privileges, and carries a scope change indicating the injected script runs in the victim's browser context rather than the server's. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated stored or reflected Cross-Site Scripting in the LeadConnector WordPress plugin (versions ≤ 4.0.5) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser session without any prior authentication. The CVSS vector confirms a scope change (S:C), meaning the injected script escapes the plugin's context and can affect the broader WordPress session environment. No public exploit code or active exploitation has been identified at time of analysis, but the lack of authentication barrier lowers the effort required to attempt attacks at scale against WordPress installations.
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated cross-site scripting in the Email Subscribers & Newsletters WordPress plugin (versions ≤ 5.9.33) by Icegram allows remote, unauthenticated attackers to inject malicious scripts that execute in the browsers of users who visit affected pages. The CVSS scope-change indicator (S:C) confirms the injected payload crosses trust boundaries into the victim's browser context, enabling session hijacking, credential theft, or administrative account takeover on the affected WordPress site. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.5.13 allows unauthenticated attackers to inject persistent malicious scripts through optional web form fields, which subsequently execute in the browsers of privileged administrative users. Successful exploitation can yield full administrative session compromise, unauthorized rogue account creation, or arbitrary site modification. A publicly available proof-of-concept is confirmed by WPScan; however, EPSS remains low at 0.17% (7th percentile), indicating limited observed mass exploitation despite that availability.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. No public exploit identified at time of analysis, and exploitation requires the plugin's 'User Role Selection' feature to be enabled.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.
SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.
PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
SQL injection in the Beautiful Taxonomy Filters WordPress plugin (versions 2.4.6 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through the plugin's taxonomy filtering logic, exposing the entire WordPress database including credentials and secrets. Rated CVSS 9.3 with a network attack vector and no privileges required, though no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The scope-changed CVSS vector signals impact reaching beyond the plugin into the shared database backing the whole site.
PHP Object Injection in the Geo Controller WordPress plugin (the plugin distributed as cf-geoplugin) affects all versions up to and including 8.9.8, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and the CVSS vector reports full confidentiality, integrity, and availability impact, a suitable gadget chain in the plugin or wider WordPress environment could lead to remote code execution, data disclosure, or site takeover. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits any authenticated subscriber to extract sensitive data from the underlying WordPress database. The CVSS 8.5 score with Scope:Changed reflects that the database read extends beyond the plugin's own tables, potentially exposing WordPress user credentials, site options, and other privileged data. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17) lets remote unauthenticated attackers (PR:N) inject arbitrary SQL through the plugin's statistics-handling code, enabling extraction of database contents such as user records and password hashes. The flaw is network-reachable with low complexity and no user interaction (CVSS 9.3, S:C/C:H). No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical but the barrier is low.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), though SSVC assesses technical impact as total if exploitation is achieved.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Arbitrary file read in the Workeera WordPress plugin (before 1.0.6) allows authenticated users with subscriber-level access to exfiltrate sensitive server files, including wp-config.php and authentication secrets. The plugin's candidate profile submission endpoint neither validates which fields a subscriber may populate nor confines file-serving operations to an approved directory, creating a path-traversal-adjacent disclosure path. No active exploitation has been identified (SSVC exploitation: none; EPSS 0.17%), but successful exploitation can fully compromise WordPress credentials and database connection strings, making the effective risk substantially higher than the low EPSS suggests for sites with open subscriber registration.
Arbitrary file deletion in the Workeera WordPress plugin before 1.0.6 lets any authenticated user with a role as low as subscriber remove files anywhere the web server can reach, because the plugin neither restricts which values a user may write to their own candidate profile nor validates/contains the stored file path before deletion. On a typical WordPress host this enables denial of service and, by deleting wp-config.php to force the installer into a fresh setup, potential full site takeover. No active exploitation is recorded (not in CISA KEV) and no public exploit has been identified; EPSS is low at 0.14%.
Unauthenticated access to a publicly reachable debug log file in the WP OAuth Server (Login with WordPress) WordPress plugin before 6.3.1 exposes sensitive credential material to any network attacker. When debug logging is enabled, the plugin writes OAuth tokens, authorization codes, and full user records including bcrypt password hashes to a fixed, predictable filesystem path that is served without access restriction. No public exploit has been identified at time of analysis, though the attack is fully automatable per SSVC assessment and requires no authentication.
Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.
Privilege escalation in the CMP WordPress plugin before 4.1.18 allows Editor-role users to overwrite arbitrary WordPress options via an unguarded AJAX settings-import action, ultimately achieving full Administrator access. The flaw is contingent on an administrator having explicitly granted Editor-role users access to CMP's admin-bar controls - a non-default configuration - making real-world exposure narrower than the CVSS 7.2 score implies. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.13% at the 3rd percentile corroborates the SSVC assessment of exploitation status 'none'; however, SSVC rates technical impact as 'total' given that successful exploitation yields unrestricted site control.
Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.
Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated arbitrary file upload in the Hash Form WordPress plugin (HashThemes) affects all versions up to and including 1.4.2, allowing a remote attacker with no authentication to upload files of arbitrary type to the server. Because the plugin fails to validate uploaded file types (CWE-434), an attacker can plant an executable PHP payload and achieve full site compromise. Rated CVSS 10.0 with a scope-change vector; no public exploit identified at time of analysis and it is not listed in CISA KEV, though the class of bug is trivially weaponizable.
Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. No public exploit code or active exploitation has been identified at time of analysis, but the PR:N unauthenticated attack vector means any internet-facing WordPress installation running this plugin version is reachable without attacker credentials.
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Email Essentials WordPress plugin by Acato (all versions through 6.0.6) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack is network-accessible, requires no privileges, and carries a scope change indicating the injected script runs in the victim's browser context rather than the server's. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated stored or reflected Cross-Site Scripting in the LeadConnector WordPress plugin (versions ≤ 4.0.5) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser session without any prior authentication. The CVSS vector confirms a scope change (S:C), meaning the injected script escapes the plugin's context and can affect the broader WordPress session environment. No public exploit code or active exploitation has been identified at time of analysis, but the lack of authentication barrier lowers the effort required to attempt attacks at scale against WordPress installations.
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated cross-site scripting in the Email Subscribers & Newsletters WordPress plugin (versions ≤ 5.9.33) by Icegram allows remote, unauthenticated attackers to inject malicious scripts that execute in the browsers of users who visit affected pages. The CVSS scope-change indicator (S:C) confirms the injected payload crosses trust boundaries into the victim's browser context, enabling session hijacking, credential theft, or administrative account takeover on the affected WordPress site. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Arbitrary file upload in the WP Legal Pages 'WP Cookie Notice for GDPR, CCPA & ePrivacy Consent' WordPress plugin (also distributed under the slug gdpr-cookie-consent) affects all versions from the initial release through 4.4.1, letting remote attackers upload files of dangerous types (e.g. PHP web shells) to the server. Because the plugin fails to restrict upload types (CWE-434), a successful upload typically yields remote code execution and full site compromise. Reported by Patchstack with a maximum CVSS of 10.0; there is no public exploit identified at time of analysis and no EPSS or KEV data supplied.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.5.13 allows unauthenticated attackers to inject persistent malicious scripts through optional web form fields, which subsequently execute in the browsers of privileged administrative users. Successful exploitation can yield full administrative session compromise, unauthorized rogue account creation, or arbitrary site modification. A publicly available proof-of-concept is confirmed by WPScan; however, EPSS remains low at 0.17% (7th percentile), indicating limited observed mass exploitation despite that availability.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Privilege escalation to Administrator in the Addify Custom User Registration Fields for WooCommerce plugin (versions ≤ 2.2.3) lets unauthenticated attackers gain admin rights by supplying an arbitrary role slug during WooCommerce checkout. The plugin trusts an attacker-controlled afreg_select_user_role value from the unauthenticated Store API /wc/store/v1/checkout request and passes it straight to WP_User::add_role() without validating it against the admin-configured allowed role list. No public exploit identified at time of analysis, and exploitation requires the plugin's 'User Role Selection' feature to be enabled.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote code execution in the Sigma Forms Pro (AI Generated Forms) WordPress plugin by bdthemes affects all versions through 1.4.5, where the handle_form_submission function temporarily grants the unfiltered_upload capability to every submitter and skips MIME validation when allowed_file_types is empty. An unauthenticated attacker can upload an executable PHP file and run arbitrary code on the server. No public exploit has been identified yet, but the flaw is immediately exploitable against default installs because shipped templates (Job Application, Support Ticket, Wholesale Application) expose unrestricted upload fields by design.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Account takeover in the Uix UserCenter WordPress plugin (all versions through 1.0.3) lets unauthenticated attackers seize any account, including administrators. The plugin's profile-update action never checks that the targeted account belongs to the requester and authorizes the action with a token signed by a hardcoded key that is identical on every installation, so an attacker can forge a valid token for any user and overwrite that user's email and password. Rated CVSS 9.8 with publicly available exploit code (WPScan), though EPSS is low at 0.14%.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
Privilege escalation to full site takeover affects the MemberHero WordPress plugin through version 6.9, where the frontend registration flow fails to restrict which account fields a visitor may set, letting unauthenticated attackers self-register with an arbitrary role - including Administrator. Version 6.9 was advertised as the fix but the patch is incomplete, so current installs remain exploitable to gain admin access and hijack existing accounts, and no fully-fixed release exists at time of analysis. Publicly available exploit code exists (WPScan), though EPSS remains low at 0.15% (4th percentile).
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.
SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the GeoDirectory WordPress plugin (versions ≤ 2.8.176) enables remote unauthenticated attackers to perform privileged administrative actions on affected WordPress sites by tricking an authenticated user into visiting a malicious page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact within the affected system once the victim's browser submits the forged request. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed and confirmed by Patchstack.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.
PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
SQL injection in the Beautiful Taxonomy Filters WordPress plugin (versions 2.4.6 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through the plugin's taxonomy filtering logic, exposing the entire WordPress database including credentials and secrets. Rated CVSS 9.3 with a network attack vector and no privileges required, though no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The scope-changed CVSS vector signals impact reaching beyond the plugin into the shared database backing the whole site.
PHP Object Injection in the Geo Controller WordPress plugin (the plugin distributed as cf-geoplugin) affects all versions up to and including 8.9.8, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and the CVSS vector reports full confidentiality, integrity, and availability impact, a suitable gadget chain in the plugin or wider WordPress environment could lead to remote code execution, data disclosure, or site takeover. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated privilege escalation in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing remote attackers with no credentials to improperly gain elevated privileges (CWE-266). Rated CVSS 9.8, the flaw grants full confidentiality, integrity, and availability impact, effectively enabling site takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits any authenticated subscriber to extract sensitive data from the underlying WordPress database. The CVSS 8.5 score with Scope:Changed reflects that the database read extends beyond the plugin's own tables, potentially exposing WordPress user credentials, site options, and other privileged data. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17) lets remote unauthenticated attackers (PR:N) inject arbitrary SQL through the plugin's statistics-handling code, enabling extraction of database contents such as user records and password hashes. The flaw is network-reachable with low complexity and no user interaction (CVSS 9.3, S:C/C:H). No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical but the barrier is low.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), though SSVC assesses technical impact as total if exploitation is achieved.
Price manipulation in the StoreGrowth WordPress plugin (versions before 2.1.2) enables unauthenticated attackers to add products to a WooCommerce cart at arbitrary, attacker-chosen prices that carry through to checkout totals - directly enabling financial fraud against affected merchants. The flaw exists across two unauthenticated AJAX actions that accept browser-supplied price values without any server-side validation, and is conditional on the BOGO (Buy One Get One) promotional feature being active. No public exploit code has been identified, and EPSS is low at 0.18% (8th percentile), though SSVC rates the attack as automatable - making mass scanning of vulnerable stores feasible.
Unrestricted file upload in the Workeera WordPress plugin before version 1.0.6 permits any subscriber-level user to upload arbitrary files - including PHP webshells - to a publicly accessible server directory via the candidate profile submission flow, achieving remote code execution. The plugin neither restricts which profile field values candidates may submit nor validates the file type before writing to the web root, mapping directly to CWE-434. No active exploitation is confirmed (CISA KEV absent, SSVC Exploitation: none), and EPSS sits at a low 0.19%, though the minimal privilege barrier makes this acutely dangerous on any multi-user WordPress job board with open registration.
Arbitrary file read in the Workeera WordPress plugin (before 1.0.6) allows authenticated users with subscriber-level access to exfiltrate sensitive server files, including wp-config.php and authentication secrets. The plugin's candidate profile submission endpoint neither validates which fields a subscriber may populate nor confines file-serving operations to an approved directory, creating a path-traversal-adjacent disclosure path. No active exploitation has been identified (SSVC exploitation: none; EPSS 0.17%), but successful exploitation can fully compromise WordPress credentials and database connection strings, making the effective risk substantially higher than the low EPSS suggests for sites with open subscriber registration.
Arbitrary file deletion in the Workeera WordPress plugin before 1.0.6 lets any authenticated user with a role as low as subscriber remove files anywhere the web server can reach, because the plugin neither restricts which values a user may write to their own candidate profile nor validates/contains the stored file path before deletion. On a typical WordPress host this enables denial of service and, by deleting wp-config.php to force the installer into a fresh setup, potential full site takeover. No active exploitation is recorded (not in CISA KEV) and no public exploit has been identified; EPSS is low at 0.14%.
Unauthenticated access to a publicly reachable debug log file in the WP OAuth Server (Login with WordPress) WordPress plugin before 6.3.1 exposes sensitive credential material to any network attacker. When debug logging is enabled, the plugin writes OAuth tokens, authorization codes, and full user records including bcrypt password hashes to a fixed, predictable filesystem path that is served without access restriction. No public exploit has been identified at time of analysis, though the attack is fully automatable per SSVC assessment and requires no authentication.
Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.
Privilege escalation in the CMP WordPress plugin before 4.1.18 allows Editor-role users to overwrite arbitrary WordPress options via an unguarded AJAX settings-import action, ultimately achieving full Administrator access. The flaw is contingent on an administrator having explicitly granted Editor-role users access to CMP's admin-bar controls - a non-default configuration - making real-world exposure narrower than the CVSS 7.2 score implies. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.13% at the 3rd percentile corroborates the SSVC assessment of exploitation status 'none'; however, SSVC rates technical impact as 'total' given that successful exploitation yields unrestricted site control.
Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for WordPress, in all versions through 1.17.8, allows unauthenticated attackers to write attacker-controlled PHP into wp-content/uploads/ via the save_attachments() function when the CRM IMAP Email Connect feature parses inbound email attachments. Because file extension validation and path normalization are both missing, a crafted email with a forged References header and a path-traversal filename escapes the .htaccess-protected crm-attachments directory, enabling remote code execution on hosts where PHP executes in the uploads directory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS base score of 9.8 reflects the unauthenticated, network-reachable nature of the flaw.
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in `mbw_get_hash_key()`, which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while `mbw_validate_auth_cookie()` performs insufficient verification - allowing the forged cookie to pass as legitimate. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the CVSS 8.8 score accurately reflects the low privilege bar required and full confidentiality, integrity, and availability impact.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.