WordPress
Monthly
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Locatoraid Store Locator WordPress plugin (versions 3.9.72 and earlier) lets remote attackers inject arbitrary SQL through the plugin's request handling, exposing the underlying WordPress database. The flaw is reachable without any authentication (PR:N) and carries a high CVSS of 9.3 with a changed scope, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Directory Pro WordPress plugin (versions 2.5.8 and earlier by e-plugins) lets remote unauthenticated attackers inject arbitrary SQL through unsanitized input, per the CVSS:3.1 vector (PR:N/UI:N), enabling database extraction against affected sites. Reported by Patchstack and rated 9.3 (Critical) with a scope-change (S:C) component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is driven by the trivial network-based attack profile rather than confirmed exploitation.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.
SQL injection in the Security & Malware Scan by CleanTalk WordPress plugin (versions 2.184 and earlier) lets remote attackers inject arbitrary SQL through unauthenticated requests, consistent with the CVSS PR:N metric. Reported by Patchstack with a CVSS 9.3, the flaw carries a scope change (S:C) and high confidentiality impact, so a successful attacker can read sensitive database contents such as WordPress user records and secret keys. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity vector makes it a high-priority patching target.
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.57.0, letting remote attackers submit crafted serialized data that is deserialized without validation to potentially achieve arbitrary object instantiation and, with a suitable POP gadget chain, remote code execution. The vulnerability carries a CVSS 9.8 rating with a fully unauthenticated network vector and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Local File Inclusion in the Golo Framework WordPress plugin before version 1.7.5 allows unauthenticated remote attackers to read arbitrary local files from the server - including wp-config.php containing database credentials - and potentially achieve code execution via PHP file inclusion mechanisms. The flaw stems from CWE-98: user-controlled input is passed unsanitized to PHP include/require statements, exploitable over the network without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network-accessible attack surface and CVSS 8.1 score make this a meaningful risk for any WordPress installation running the affected plugin.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution affects the Elementor Pro WordPress plugin from unspecified early versions through 4.2.1, allowing a remote attacker with no credentials to upload a dangerously-typed file (e.g. a PHP webshell) and execute code on the hosting server. Reported by Patchstack and carrying a critical 9.0 CVSS score with a scope-changing vector, the flaw can result in full site and potentially host compromise. No public exploit identified at time of analysis, though Patchstack's write-up explicitly frames it as an unauthenticated file-upload-to-RCE path, making it a high-priority patch for any WordPress site running the Pro add-on.
Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. No public exploit has been identified at time of analysis, and EPSS/KEV data were not provided.
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Unauthenticated broken access control in the Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) allows remote unauthenticated attackers to modify plugin options, resulting in high integrity impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has permission before processing option-change requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a low-barrier, fully network-exploitable condition.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated SQL injection in the Maps Marker Pro WordPress plugin (all versions up to and including 4.32) lets remote attackers inject arbitrary SQL against the site database without any credentials or user interaction. Reported by Patchstack and rated CVSS 9.3, the flaw exposes the backing WordPress database to unauthenticated extraction. No public exploit has been identified at the time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
SQL injection in Community by PeepSo versions up to and including 9.0.5.2 is reachable by any subscriber-level authenticated user, enabling network-based extraction of sensitive database contents with a changed scope. Classified under CWE-89, the flaw requires only low-privilege WordPress credentials and no user interaction, lowering the exploitation barrier to any registered site member. No public exploit code or CISA KEV listing is identified at time of analysis, but the minimal privilege requirement and high confidentiality impact make this a high-priority finding for sites with open registration.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.85 through below 5.4.7) enables unauthenticated network attackers to inject an arbitrary certificate into the site's SAML trust store by exploiting the plugin's failure to verify incoming SAML response signatures before persisting embedded certificates. Once stored, that attacker-controlled certificate can be promoted to the site's active trusted signing authority via a single administrator UI click, after which the attacker can forge SAML assertions and authenticate as any WordPress user, including site administrators. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is very low at 0.11% (1st percentile), reflecting limited observed exploitation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.
Account takeover in the TrueBooker WordPress plugin (all versions before 1.2.7) lets remote unauthenticated attackers change the email address of any registered user - including administrators - through AJAX actions that lack authorisation checks, then hijack the account via WordPress's standard password-reset flow. The flaw carries a CVSS 9.8 and is fixed in 1.2.7; there is no public exploit identified at time of analysis, and EPSS remains low (0.15%, 4th percentile), reflecting limited observed weaponisation despite the critical rating.
Arbitrary file write in the W3 Total Cache WordPress plugin before 2.10.5 lets unauthenticated remote attackers overwrite any existing file inside or outside the web root by manipulating the request path used to construct cache file names. Because the plugin builds cache filenames from an unvalidated path, attackers can clobber security-critical files such as Apache .htaccess, breaking the site and stripping hardening rules that other controls depend on. No public exploit identified at time of analysis and EPSS is low (0.18%), but SSVC rates technical impact as total and the flaw is automatable, so priority is high despite the current lack of observed exploitation.
Authentication bypass in the TabaPay Gateway WordPress plugin (versions through 1.4.0) lets unauthenticated remote attackers log in as any registered user - including administrators - by abusing the payment callback handler. Because the plugin establishes a session for the account tied to a referenced order without validating the payment callback's authenticity, an attacker who can reach the callback endpoint can impersonate arbitrary accounts. No public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), but the flaw is trivially exploitable and CISA's SSVC framework rates it fully automatable with total technical impact.
Server-Side Request Forgery in Animation Addons for Elementor WordPress plugin (versions before 2.7.2) permits unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal network hosts and relay the responses back to the attacker. The vulnerability stems from unsanitized user-supplied input being used directly to construct the host component of a server-side HTTP request. No public exploit or CISA KEV listing has been identified, and EPSS places exploitation probability at 0.15% (4th percentile), though SSVC notes the attack is automatable.
Unauthenticated SQL injection in the Product Shortlist WordPress plugin (versions through 1.0.4) allows any remote attacker to query the underlying MySQL database without credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects trivial network exploitation with a scope change, meaning data accessible extends beyond the plugin's own tables to the shared WordPress database. No public exploit identified at time of analysis, and the EPSS score of 0.19% (9th percentile) suggests limited observed exploitation activity consistent with a niche plugin install base.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Unauthenticated path traversal in the Simple File List WordPress plugin (versions through 6.3.11) exposes an unvalidated file-move endpoint accessible without authentication, enabling arbitrary server file reads and displacement of critical WordPress files outside the web root. Remote attackers can exfiltrate sensitive data such as wp-config.php database credentials and secret keys, and can displace core WordPress files to cause site failure or enable site takeover. No public exploit code has been identified at time of analysis, but the CISA SSVC framework rates the attack as automatable with no privileges required, elevating real-world risk despite a low current EPSS score.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated account lockout in the User Verification by PickPlugins WordPress plugin (through version 2.0.47) enables remote attackers to reset the email-verification status of any WordPress account - including administrators - by exploiting two authorization failures simultaneously: the resend-verification endpoint neither validates that the requestor is authorized to act on the specified user ID, nor binds the protective token to the targeted user. This effectively provides a remote, zero-privilege mechanism to lock any site account out of access. No public exploit code exists at the time of analysis, though SSVC classifies the attack as automatable, meaning bulk account disruption campaigns are technically feasible.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Improper access control in the Eventin WordPress plugin before 4.1.21 allows any authenticated user holding contributor-level access or higher to permanently delete arbitrary user accounts on the affected WordPress installation. The plugin's account deletion functionality omits both ownership verification and WordPress capability checks, meaning a low-privilege contributor can target and remove administrator accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the low technical barrier makes this a meaningful privilege-abuse risk on multi-author WordPress sites.
Unauthorized event takeover in the Eventin WordPress plugin (all versions before 4.1.21) allows any authenticated contributor-level user to modify, delete, or reassign events owned by other users - including site administrators. The flaw is a classic Insecure Direct Object Reference (IDOR) rooted in CWE-639: the plugin processes event operations using a user-supplied event identifier without verifying the requesting user actually owns or has authorization over the targeted record. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code was identified at time of analysis, but the low privilege bar and mechanically simple IDOR exploitation pattern elevate real-world risk for any multi-author WordPress deployment.
Unauthenticated SQL injection and unauthorized data destruction affect the Dinatur WordPress plugin through version 1.18. The same vulnerable request handler accepts unsanitized user input directly into SQL queries and also executes a full database table truncation with no authorization check - meaning any unauthenticated visitor can both exfiltrate WordPress database contents and irreversibly wipe the plugin's stored data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier exploitation (no credentials, no special configuration) makes this a high-urgency finding for any site running the affected plugin.
Missing capability checks in the Advanced File Manager WordPress plugin (before 5.4.13) allow any authenticated user holding administrator-delegated file-manager access - as low as Subscriber - to read arbitrary server files including wp-config.php and to overwrite existing non-PHP files, creating a direct path to full WordPress site compromise. The CVSS 8.5 score with a scope-changed vector reflects the severity of that impact, while AC:H captures the critical prerequisite: an administrator must explicitly grant file-manager access to low-privileged roles before exploitation is possible. No public exploit has been identified at time of analysis, and a vendor patch is available in version 5.4.13.
Arbitrary file deletion in the Atarim AI Agency for WordPress plugin (all versions through 5.1.1) allows authenticated attackers holding author-level credentials to delete any file on the underlying server via a chained directory traversal attack, with a direct path to remote code execution. The exploit chain poisons WordPress attachment metadata with a traversal path and then triggers the plugin's media replacement workflow to resolve and unlink the attacker-chosen target file. No public exploit has been identified at time of analysis, but the Wordfence advisory fully documents the two-step chain against verified source code, making independent reproduction straightforward for a moderately skilled attacker.
Cross-site request forgery in HashBar - WordPress Notification Bar plugin through version 2.0.0 allows a remote unauthenticated attacker to perform unauthorized administrative actions by tricking a logged-in WordPress administrator into visiting a crafted webpage. Reported by Patchstack (audit@patchstack.com) and registered as EUVD-2026-62209, this flaw carries a CVSS 8.8 score reflecting high C/I/A impact ratings, though the realistic blast radius depends on which admin-facing functions the plugin exposes to forged requests. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.
PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
SQL injection in the eShipper Commerce WordPress plugin (versions 2.16.13 and earlier) allows subscriber-level authenticated attackers to issue malicious queries against the underlying WordPress database, with scope extending beyond the plugin's own tables due to the CVSS scope-changed flag (S:C), exposing high-confidentiality data such as customer PII, order records, and potentially hashed credentials. The 'Subscriber' designation in the CVE title maps to the lowest default WordPress user role, meaning any registered site user is a viable attacker without elevated privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets remote, unauthenticated attackers inject arbitrary SQL through the booking workflow, per Patchstack (CVSS 9.3, CWE-89). Because the flaw is reachable without authentication or user interaction (PR:N/UI:N), any WordPress site running the vulnerable Pro plugin is exposed to database compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so this is a high-severity-but-not-yet-weaponized issue.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Privilege escalation in Abandoned Cart Pro for WooCommerce (Tyche Softwares) affects all versions up to and including 10.4.0, allowing an unauthenticated remote attacker to gain elevated privileges over a WordPress site. The CVSS 3.1 vector (AV:N/PR:N/UI:N) with a 9.8 score indicates the flaw is reachable over the network without credentials or user interaction, and yields full confidentiality, integrity, and availability impact. Reported by Patchstack; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Locatoraid Store Locator WordPress plugin (versions 3.9.72 and earlier) lets remote attackers inject arbitrary SQL through the plugin's request handling, exposing the underlying WordPress database. The flaw is reachable without any authentication (PR:N) and carries a high CVSS of 9.3 with a changed scope, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Directory Pro WordPress plugin (versions 2.5.8 and earlier by e-plugins) lets remote unauthenticated attackers inject arbitrary SQL through unsanitized input, per the CVSS:3.1 vector (PR:N/UI:N), enabling database extraction against affected sites. Reported by Patchstack and rated 9.3 (Critical) with a scope-change (S:C) component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is driven by the trivial network-based attack profile rather than confirmed exploitation.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.
SQL injection in the Security & Malware Scan by CleanTalk WordPress plugin (versions 2.184 and earlier) lets remote attackers inject arbitrary SQL through unauthenticated requests, consistent with the CVSS PR:N metric. Reported by Patchstack with a CVSS 9.3, the flaw carries a scope change (S:C) and high confidentiality impact, so a successful attacker can read sensitive database contents such as WordPress user records and secret keys. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity vector makes it a high-priority patching target.
SQL injection in the rtMedia for WordPress, BuddyPress and bbPress plugin (versions 4.7.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into a backend query, per a Patchstack-reported advisory. With CVSS 9.3 and a scope-changed vector, successful exploitation exposes sensitive database contents (WordPress user records, session/auth data, private media metadata) without any login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it high-priority for any site running the plugin.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.57.0, letting remote attackers submit crafted serialized data that is deserialized without validation to potentially achieve arbitrary object instantiation and, with a suitable POP gadget chain, remote code execution. The vulnerability carries a CVSS 9.8 rating with a fully unauthenticated network vector and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Local File Inclusion in the Golo Framework WordPress plugin before version 1.7.5 allows unauthenticated remote attackers to read arbitrary local files from the server - including wp-config.php containing database credentials - and potentially achieve code execution via PHP file inclusion mechanisms. The flaw stems from CWE-98: user-controlled input is passed unsanitized to PHP include/require statements, exploitable over the network without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network-accessible attack surface and CVSS 8.1 score make this a meaningful risk for any WordPress installation running the affected plugin.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. Publicly available exploit code exists (reported by WPScan), and the flaw is rated CVSS 9.8 with SSVC technical impact assessed as total.
Remote code execution in the Depicter Popup & Slider Builder WordPress plugin (all versions before 4.8.0) is achievable by authenticated editor-level users who exploit the plugin's import feature to upload arbitrary PHP files to web-accessible directories. The plugin performs no file type validation and does not remove malformed or rejected uploads, allowing a PHP webshell to persist and be directly executed via HTTP request. A publicly available POC from WPScan exists; however, SSVC data indicates no confirmed exploitation to date and the attack is not automatable due to the mandatory editor-privilege requirement.
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution affects the Elementor Pro WordPress plugin from unspecified early versions through 4.2.1, allowing a remote attacker with no credentials to upload a dangerously-typed file (e.g. a PHP webshell) and execute code on the hosting server. Reported by Patchstack and carrying a critical 9.0 CVSS score with a scope-changing vector, the flaw can result in full site and potentially host compromise. No public exploit identified at time of analysis, though Patchstack's write-up explicitly frames it as an unauthenticated file-upload-to-RCE path, making it a high-priority patch for any WordPress site running the Pro add-on.
Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. No public exploit has been identified at time of analysis, and EPSS/KEV data were not provided.
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Unauthenticated broken access control in the Outranking Plugin Options WordPress plugin (versions 1.1.3 and below) allows remote unauthenticated attackers to modify plugin options, resulting in high integrity impact. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has permission before processing option-change requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a low-barrier, fully network-exploitable condition.
Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated SQL injection in the Maps Marker Pro WordPress plugin (all versions up to and including 4.32) lets remote attackers inject arbitrary SQL against the site database without any credentials or user interaction. Reported by Patchstack and rated CVSS 9.3, the flaw exposes the backing WordPress database to unauthenticated extraction. No public exploit has been identified at the time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
SQL injection in Community by PeepSo versions up to and including 9.0.5.2 is reachable by any subscriber-level authenticated user, enabling network-based extraction of sensitive database contents with a changed scope. Classified under CWE-89, the flaw requires only low-privilege WordPress credentials and no user interaction, lowering the exploitation barrier to any registered site member. No public exploit code or CISA KEV listing is identified at time of analysis, but the minimal privilege requirement and high confidentiality impact make this a high-priority finding for sites with open registration.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Stitch Express WordPress plugin (versions <= 1.9.0) allows unauthenticated network attackers to perform privileged operations by bypassing missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms zero-friction remote exploitation with high integrity impact, meaning unauthorized data modification or administrative action is achievable without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.85 through below 5.4.7) enables unauthenticated network attackers to inject an arbitrary certificate into the site's SAML trust store by exploiting the plugin's failure to verify incoming SAML response signatures before persisting embedded certificates. Once stored, that attacker-controlled certificate can be promoted to the site's active trusted signing authority via a single administrator UI click, after which the attacker can forge SAML assertions and authenticate as any WordPress user, including site administrators. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is very low at 0.11% (1st percentile), reflecting limited observed exploitation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.
Account takeover in the TrueBooker WordPress plugin (all versions before 1.2.7) lets remote unauthenticated attackers change the email address of any registered user - including administrators - through AJAX actions that lack authorisation checks, then hijack the account via WordPress's standard password-reset flow. The flaw carries a CVSS 9.8 and is fixed in 1.2.7; there is no public exploit identified at time of analysis, and EPSS remains low (0.15%, 4th percentile), reflecting limited observed weaponisation despite the critical rating.
Arbitrary file write in the W3 Total Cache WordPress plugin before 2.10.5 lets unauthenticated remote attackers overwrite any existing file inside or outside the web root by manipulating the request path used to construct cache file names. Because the plugin builds cache filenames from an unvalidated path, attackers can clobber security-critical files such as Apache .htaccess, breaking the site and stripping hardening rules that other controls depend on. No public exploit identified at time of analysis and EPSS is low (0.18%), but SSVC rates technical impact as total and the flaw is automatable, so priority is high despite the current lack of observed exploitation.
Authentication bypass in the TabaPay Gateway WordPress plugin (versions through 1.4.0) lets unauthenticated remote attackers log in as any registered user - including administrators - by abusing the payment callback handler. Because the plugin establishes a session for the account tied to a referenced order without validating the payment callback's authenticity, an attacker who can reach the callback endpoint can impersonate arbitrary accounts. No public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), but the flaw is trivially exploitable and CISA's SSVC framework rates it fully automatable with total technical impact.
Server-Side Request Forgery in Animation Addons for Elementor WordPress plugin (versions before 2.7.2) permits unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal network hosts and relay the responses back to the attacker. The vulnerability stems from unsanitized user-supplied input being used directly to construct the host component of a server-side HTTP request. No public exploit or CISA KEV listing has been identified, and EPSS places exploitation probability at 0.15% (4th percentile), though SSVC notes the attack is automatable.
Unauthenticated SQL injection in the Product Shortlist WordPress plugin (versions through 1.0.4) allows any remote attacker to query the underlying MySQL database without credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects trivial network exploitation with a scope change, meaning data accessible extends beyond the plugin's own tables to the shared WordPress database. No public exploit identified at time of analysis, and the EPSS score of 0.19% (9th percentile) suggests limited observed exploitation activity consistent with a niche plugin install base.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Unauthenticated path traversal in the Simple File List WordPress plugin (versions through 6.3.11) exposes an unvalidated file-move endpoint accessible without authentication, enabling arbitrary server file reads and displacement of critical WordPress files outside the web root. Remote attackers can exfiltrate sensitive data such as wp-config.php database credentials and secret keys, and can displace core WordPress files to cause site failure or enable site takeover. No public exploit code has been identified at time of analysis, but the CISA SSVC framework rates the attack as automatable with no privileges required, elevating real-world risk despite a low current EPSS score.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated account lockout in the User Verification by PickPlugins WordPress plugin (through version 2.0.47) enables remote attackers to reset the email-verification status of any WordPress account - including administrators - by exploiting two authorization failures simultaneously: the resend-verification endpoint neither validates that the requestor is authorized to act on the specified user ID, nor binds the protective token to the targeted user. This effectively provides a remote, zero-privilege mechanism to lock any site account out of access. No public exploit code exists at the time of analysis, though SSVC classifies the attack as automatable, meaning bulk account disruption campaigns are technically feasible.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Improper access control in the Eventin WordPress plugin before 4.1.21 allows any authenticated user holding contributor-level access or higher to permanently delete arbitrary user accounts on the affected WordPress installation. The plugin's account deletion functionality omits both ownership verification and WordPress capability checks, meaning a low-privilege contributor can target and remove administrator accounts. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the low technical barrier makes this a meaningful privilege-abuse risk on multi-author WordPress sites.
Unauthorized event takeover in the Eventin WordPress plugin (all versions before 4.1.21) allows any authenticated contributor-level user to modify, delete, or reassign events owned by other users - including site administrators. The flaw is a classic Insecure Direct Object Reference (IDOR) rooted in CWE-639: the plugin processes event operations using a user-supplied event identifier without verifying the requesting user actually owns or has authorization over the targeted record. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code was identified at time of analysis, but the low privilege bar and mechanically simple IDOR exploitation pattern elevate real-world risk for any multi-author WordPress deployment.
Unauthenticated SQL injection and unauthorized data destruction affect the Dinatur WordPress plugin through version 1.18. The same vulnerable request handler accepts unsanitized user input directly into SQL queries and also executes a full database table truncation with no authorization check - meaning any unauthenticated visitor can both exfiltrate WordPress database contents and irreversibly wipe the plugin's stored data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier exploitation (no credentials, no special configuration) makes this a high-urgency finding for any site running the affected plugin.
Missing capability checks in the Advanced File Manager WordPress plugin (before 5.4.13) allow any authenticated user holding administrator-delegated file-manager access - as low as Subscriber - to read arbitrary server files including wp-config.php and to overwrite existing non-PHP files, creating a direct path to full WordPress site compromise. The CVSS 8.5 score with a scope-changed vector reflects the severity of that impact, while AC:H captures the critical prerequisite: an administrator must explicitly grant file-manager access to low-privileged roles before exploitation is possible. No public exploit has been identified at time of analysis, and a vendor patch is available in version 5.4.13.
Arbitrary file deletion in the Atarim AI Agency for WordPress plugin (all versions through 5.1.1) allows authenticated attackers holding author-level credentials to delete any file on the underlying server via a chained directory traversal attack, with a direct path to remote code execution. The exploit chain poisons WordPress attachment metadata with a traversal path and then triggers the plugin's media replacement workflow to resolve and unlink the attacker-chosen target file. No public exploit has been identified at time of analysis, but the Wordfence advisory fully documents the two-step chain against verified source code, making independent reproduction straightforward for a moderately skilled attacker.
Cross-site request forgery in HashBar - WordPress Notification Bar plugin through version 2.0.0 allows a remote unauthenticated attacker to perform unauthorized administrative actions by tricking a logged-in WordPress administrator into visiting a crafted webpage. Reported by Patchstack (audit@patchstack.com) and registered as EUVD-2026-62209, this flaw carries a CVSS 8.8 score reflecting high C/I/A impact ratings, though the realistic blast radius depends on which admin-facing functions the plugin exposes to forged requests. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.
PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.