WordPress
Monthly
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in MWB HubSpot for WooCommerce versions 1.6.7 and earlier allows subscriber-level authenticated WordPress users to bypass access controls and invoke functionality reserved for higher-privileged roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) places the primary impact on availability (High), with limited integrity impact and no confirmed confidentiality exposure - notable given the 'Information Disclosure' tag applied by Patchstack, which is not reconciled by the official scoring. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated SQL injection in the WordPress plugin Affiliates Manager (by wp.insider) through version 2.9.53 lets remote attackers inject crafted SQL through affiliate-facing input without any authentication (PR:N), enabling extraction of sensitive database contents such as user records, affiliate payout data, and WordPress secrets. The high CVSS base score of 9.3 is driven by network reach, low complexity, and a scope change (S:C) reflecting impact on the wider WordPress database beyond the plugin's own tables. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but SQLi in a public-facing WordPress plugin is a well-understood and easily weaponized class.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
SQL injection in License Manager for WooCommerce (versions ≤ 3.0.18) enables authenticated customers to execute arbitrary SQL queries against the underlying WordPress database, achieving a scope change that exposes high-confidentiality data across the shared database - including license keys, customer PII, WooCommerce order records, and hashed WordPress credentials. Exploitation requires only a low-privilege customer account, making the attack surface broad on stores with open registration. No public exploit code or CISA KEV listing has been identified at time of analysis, though SQL injection in WordPress plugins is a historically well-understood attack class that lowers the barrier to POC development post-disclosure.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild.
SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (by gingerplugins) affects all versions up to and including 1.4.2, allowing remote unauthenticated attackers to inject arbitrary SQL and read sensitive database contents. Rated CVSS 9.3 with a scope-changed vector, it requires no authentication or user interaction, making it directly reachable on any site running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature of the flaw substantially lowers the bar for exploitation.
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
SQL injection exploitable by authenticated subscribers in Gravity Forms Bookings Premium versions through 2.1 enables remote database extraction from affected WordPress installations. The CVSS 8.5 rating reflects network accessibility, low attack complexity, subscriber-level privilege requirements, and a scope change that extends confidentiality impact to the underlying database layer beyond the plugin itself. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege threshold significantly broadens the realistic attacker pool on sites with open user registration.
PHP Object Injection in the Essential Real Estate WordPress plugin (≤ 5.3.3) by g5theme allows low-privileged authenticated users to pass a crafted serialized PHP object through a vulnerable unserialize() call, potentially triggering arbitrary code execution if a usable POP (Property-Oriented Programming) gadget chain exists within the WordPress installation. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact - realistic in WordPress environments where co-installed plugins routinely supply gadget chains. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Local File Inclusion in the Theme Test Drive WordPress plugin (versions <= 2.9.1) enables unauthenticated network-based attackers to supply arbitrary file paths to the theme preview mechanism, potentially exposing sensitive server files such as wp-config.php and - under certain server configurations - escalating to remote code execution via log poisoning or similar chaining techniques. The vulnerability is classified under CWE-98 (PHP File Inclusion) with a CVSS 8.1 score reflecting no authentication requirement but elevated attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Unauthenticated access to the classifieds-types REST endpoint in WPAdverts - Classifieds Plugin for WordPress (all versions through 2.3.2) exposes internal site configuration data due to a missing authorization check in class-rest-blocks.php. Remote attackers without any credentials can retrieve registered post types, taxonomy definitions, form schema metadata, contact options, and custom field meta keys - information that supports targeted reconnaissance for follow-on attacks. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the CVSS AV:N/PR:N vector means any internet-facing WordPress site running the affected plugin version is reachable without precondition.
Remote code execution in WordPress exposes sites to full server compromise when an Author-level (or higher) authenticated user uploads a specially crafted PostScript file that is subsequently processed by Imagick and Ghostscript. The vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), leverages Ghostscript's Turing-complete PostScript interpreter to execute arbitrary OS-level commands under the web server's process identity. No public exploit has been identified at time of analysis, but the low privilege bar - requiring only an Author account - and WordPress's massive global deployment footprint make this a high-priority remediation item for any self-hosted installation running Imagick with Ghostscript.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the `_gallery_order_{post_id}` POST parameter. The `gllr_save_postdata()` function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributor-level users to persistently configure a malicious webhook URL via the Form Builder widget, which is then dispatched by an AJAX handler registered for both authenticated and unauthenticated callers - meaning the trigger phase requires no authentication at all. The root flaw is that wp_remote_post() is invoked on the stored URL with no host allowlist, no scheme restriction, and no private/loopback IP filtering, despite the plugin containing wpr_is_blocked_remote_host and wpr_is_private_or_local_ip helpers that are simply not called on this code path. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated attackers remove any file the web server can write to, escalating to full site takeover when critical files like wp-config.php are deleted. The flaw stems from missing path validation in the proSol_fileDeleteProcess handler, which trusts a traversal key that the attacker plants in their own session via a preceding proSol_fileUploadModalProcess call; both steps require only the publicly exposed frontend nonce. No public exploit identified at time of analysis, but the network, no-auth, no-interaction profile and 9.1 CVSS make this a high-priority patch.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.3) allows authenticated contributors to destroy critical server files and fully compromise the WordPress installation. The root cause is a PHP deserialization flaw in the shownotes REST API that activates a native POP chain via GenerationGuard::__destruct(), invoking wp_delete_file() on an attacker-controlled path - enabling deletion of wp-config.php to force WordPress into reinstallation mode. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the POP chain is explicitly mapped in the CVE with source code references, indicating high confidence in exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Arbitrary file deletion in the Link Library WordPress plugin (all versions through 7.9.4) lets unauthenticated attackers submit a malicious link whose crafted path traversal payload causes an arbitrary file on the server to be deleted when an administrator later removes the link; deleting wp-config.php can escalate to remote code execution by dropping WordPress into its setup routine. Reported by Wordfence and fixed in 7.9.5, this issue carries a 9.1 CVSS but has no public exploit identified at time of analysis and is not on CISA KEV, and real exploitation hinges on a non-default plugin option being enabled. Impact is integrity and availability loss with a plausible path to full site takeover.
Unauthenticated privilege escalation in the Pods - Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) lets remote attackers bypass every authorization guard on the pods_admin AJAX router and perform administrator-level actions. Because failed checks return false instead of halting execution, an attacker with no account can promote themselves to Administrator or overwrite any user's password - including the site owner's - leading to full site takeover. Reported by Wordfence; no public exploit identified at time of analysis, though the root cause is precisely described.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in MWB HubSpot for WooCommerce versions 1.6.7 and earlier allows subscriber-level authenticated WordPress users to bypass access controls and invoke functionality reserved for higher-privileged roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) places the primary impact on availability (High), with limited integrity impact and no confirmed confidentiality exposure - notable given the 'Information Disclosure' tag applied by Patchstack, which is not reconciled by the official scoring. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.
Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated SQL injection in the WordPress plugin Affiliates Manager (by wp.insider) through version 2.9.53 lets remote attackers inject crafted SQL through affiliate-facing input without any authentication (PR:N), enabling extraction of sensitive database contents such as user records, affiliate payout data, and WordPress secrets. The high CVSS base score of 9.3 is driven by network reach, low complexity, and a scope change (S:C) reflecting impact on the wider WordPress database beyond the plugin's own tables. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but SQLi in a public-facing WordPress plugin is a well-understood and easily weaponized class.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
SQL injection in License Manager for WooCommerce (versions ≤ 3.0.18) enables authenticated customers to execute arbitrary SQL queries against the underlying WordPress database, achieving a scope change that exposes high-confidentiality data across the shared database - including license keys, customer PII, WooCommerce order records, and hashed WordPress credentials. Exploitation requires only a low-privilege customer account, making the attack surface broad on stores with open registration. No public exploit code or CISA KEV listing has been identified at time of analysis, though SQL injection in WordPress plugins is a historically well-understood attack class that lowers the barrier to POC development post-disclosure.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild.
SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in the Sticky Chat Widget WordPress plugin (by gingerplugins) affects all versions up to and including 1.4.2, allowing remote unauthenticated attackers to inject arbitrary SQL and read sensitive database contents. Rated CVSS 9.3 with a scope-changed vector, it requires no authentication or user interaction, making it directly reachable on any site running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion via unauthenticated CSRF in the Slider by 10Web WordPress plugin (versions up to and including 1.2.62) enables a remote attacker to delete files on the WordPress host by tricking an authenticated administrator into visiting a malicious page. Per the Patchstack advisory title, the CSRF primitive chains directly to arbitrary file deletion, which is reflected in the CVSS 3.1 score of 7.4 (High) with Scope Changed (S:C) and High Availability impact (A:H), indicating the destruction extends beyond the plugin itself to the broader WordPress installation or filesystem. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Arbitrary file upload in GP Premium (the premium companion plugin for the GeneratePress WordPress theme) through version 2.5.5 allows attackers holding a low-privileged Contributor account to upload arbitrary files, enabling web shell deployment and full site compromise. Rated CVSS 9.9 with a scope-changing vector, it is reported by Patchstack and tracked as EUVD-2026-60916; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The low privilege barrier (any Contributor) combined with high confidentiality, integrity and availability impact makes this a severe multi-tenant and membership-site risk.
Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature of the flaw substantially lowers the bar for exploitation.
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
SQL injection exploitable by authenticated subscribers in Gravity Forms Bookings Premium versions through 2.1 enables remote database extraction from affected WordPress installations. The CVSS 8.5 rating reflects network accessibility, low attack complexity, subscriber-level privilege requirements, and a scope change that extends confidentiality impact to the underlying database layer beyond the plugin itself. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege threshold significantly broadens the realistic attacker pool on sites with open user registration.
PHP Object Injection in the Essential Real Estate WordPress plugin (≤ 5.3.3) by g5theme allows low-privileged authenticated users to pass a crafted serialized PHP object through a vulnerable unserialize() call, potentially triggering arbitrary code execution if a usable POP (Property-Oriented Programming) gadget chain exists within the WordPress installation. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact - realistic in WordPress environments where co-installed plugins routinely supply gadget chains. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Local File Inclusion in the Theme Test Drive WordPress plugin (versions <= 2.9.1) enables unauthenticated network-based attackers to supply arbitrary file paths to the theme preview mechanism, potentially exposing sensitive server files such as wp-config.php and - under certain server configurations - escalating to remote code execution via log poisoning or similar chaining techniques. The vulnerability is classified under CWE-98 (PHP File Inclusion) with a CVSS 8.1 score reflecting no authentication requirement but elevated attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file upload in the WordPress plugin Sync Post With Other Site (versions 1.9.3 and earlier) lets a user holding only Contributor-level privileges upload files of any type, including PHP webshells, bypassing WordPress's normal media-type restrictions. Because the flaw carries a scope-changed CVSS 3.1 score of 9.9, a successful upload typically escalates to remote code execution and full site compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low authentication barrier and high impact make it a strong patch priority.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. Reported by Wordfence and carrying a CVSS 9.8, this is a critical, network-reachable flaw with no authentication barrier, though there is no public exploit identified at time of analysis.
Unauthenticated access to the classifieds-types REST endpoint in WPAdverts - Classifieds Plugin for WordPress (all versions through 2.3.2) exposes internal site configuration data due to a missing authorization check in class-rest-blocks.php. Remote attackers without any credentials can retrieve registered post types, taxonomy definitions, form schema metadata, contact options, and custom field meta keys - information that supports targeted reconnaissance for follow-on attacks. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the CVSS AV:N/PR:N vector means any internet-facing WordPress site running the affected plugin version is reachable without precondition.
Remote code execution in WordPress exposes sites to full server compromise when an Author-level (or higher) authenticated user uploads a specially crafted PostScript file that is subsequently processed by Imagick and Ghostscript. The vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), leverages Ghostscript's Turing-complete PostScript interpreter to execute arbitrary OS-level commands under the web server's process identity. No public exploit has been identified at time of analysis, but the low privilege bar - requiring only an Author account - and WordPress's massive global deployment footprint make this a high-priority remediation item for any self-hosted installation running Imagick with Ghostscript.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the `_gallery_order_{post_id}` POST parameter. The `gllr_save_postdata()` function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. Not listed in CISA KEV and EPSS is low (0.16%, 6th percentile), indicating little observed real-world exploitation.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Authentication bypass in the Simple JWT Login WordPress plugin before 3.6.8 lets unauthenticated attackers log in as any user - including administrators - by presenting a valid Google identity token that carries the victim's email address. Because the plugin never checks the token's audience (aud) claim, a Google-issued ID token minted for an entirely different OAuth application is accepted as proof of identity, turning any site with Google sign-in enabled into a full-account-takeover target. Publicly available exploit details exist (WPScan), though EPSS remains low (0.16%) and the flaw is not listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Unauthorized data destruction in the Solace Extra WordPress plugin (versions through 1.6.0) lets low-privileged authenticated users invoke the import_zip() AJAX handler, which lacks a capability check. Because the handler trusts only the site-wide 'ajax-nonce' that WordPress emits on every admin page to any logged-in user, Subscriber-level accounts can wipe navigation menus, sidebar widgets, all theme mods, and Elementor templates, and force arbitrary demo-content imports. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path and 9.1 CVSS make it a high-priority integrity/availability issue.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributor-level users to persistently configure a malicious webhook URL via the Form Builder widget, which is then dispatched by an AJAX handler registered for both authenticated and unauthenticated callers - meaning the trigger phase requires no authentication at all. The root flaw is that wp_remote_post() is invoked on the stored URL with no host allowlist, no scheme restriction, and no private/loopback IP filtering, despite the plugin containing wpr_is_blocked_remote_host and wpr_is_private_or_local_ip helpers that are simply not called on this code path. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion in the ProSolution WP Client WordPress plugin (all versions through 2.0.8) lets unauthenticated attackers remove any file the web server can write to, escalating to full site takeover when critical files like wp-config.php are deleted. The flaw stems from missing path validation in the proSol_fileDeleteProcess handler, which trusts a traversal key that the attacker plants in their own session via a preceding proSol_fileUploadModalProcess call; both steps require only the publicly exposed frontend nonce. No public exploit identified at time of analysis, but the network, no-auth, no-interaction profile and 9.1 CVSS make this a high-priority patch.
Unauthenticated arbitrary file upload leading to remote code execution affects the ProSolution WP Client WordPress plugin in all versions through 2.0.10, via the proSol_handleFileUpload function. The handler trusts the attacker-supplied Content-Disposition filename over the validated multipart filename and, critically, fails to delete files that its post-save extension check rejects, so a malicious PHP file remains on disk and executable. Because the gating nonce is publicly leaked through wp_localize_script on any page rendering the job-portal shortcode, no authentication is required; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS of 9.8 reflects trivial exploitability.
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.3) allows authenticated contributors to destroy critical server files and fully compromise the WordPress installation. The root cause is a PHP deserialization flaw in the shownotes REST API that activates a native POP chain via GenerationGuard::__destruct(), invoking wp_delete_file() on an attacker-controlled path - enabling deletion of wp-config.php to force WordPress into reinstallation mode. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the POP chain is explicitly mapped in the CVE with source code references, indicating high confidence in exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Arbitrary file deletion in the Link Library WordPress plugin (all versions through 7.9.4) lets unauthenticated attackers submit a malicious link whose crafted path traversal payload causes an arbitrary file on the server to be deleted when an administrator later removes the link; deleting wp-config.php can escalate to remote code execution by dropping WordPress into its setup routine. Reported by Wordfence and fixed in 7.9.5, this issue carries a 9.1 CVSS but has no public exploit identified at time of analysis and is not on CISA KEV, and real exploitation hinges on a non-default plugin option being enabled. Impact is integrity and availability loss with a plausible path to full site takeover.
Unauthenticated privilege escalation in the Pods - Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) lets remote attackers bypass every authorization guard on the pods_admin AJAX router and perform administrator-level actions. Because failed checks return false instead of halting execution, an attacker with no account can promote themselves to Administrator or overwrite any user's password - including the site owner's - leading to full site takeover. Reported by Wordfence; no public exploit identified at time of analysis, though the root cause is precisely described.
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.