WordPress
Monthly
Account takeover in the TrueBooker appointment-booking plugin for WordPress (all versions through 1.2.6) lets remote attackers hijack any account, including administrators. The add_front_user_update() AJAX action is exposed to unauthenticated visitors and trusts a caller-supplied truebooker_wp_user_id, so an attacker can rewrite an admin's email address and then use WordPress's built-in password-reset flow to seize the account. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS of 9.8.
Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in `allow_attachment_actions()` confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.
Authentication bypass in the User Profile Builder WordPress plugin (versions through 3.16.4) lets unauthenticated attackers log in as the site's Administrator (user ID 1) by submitting a registration with a 61-70 character username, resulting in full site takeover. The flaw is a PHP type-confusion bug where an error object is silently coerced to the integer 1, binding an autologin nonce to the admin account. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact defective code path.
Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.
Unauthenticated information disclosure in Product Feed PRO for WooCommerce by AdTribes (WordPress plugin) before version 13.5.7 exposes sensitive WooCommerce store configuration to any remote party without credentials. A missing authorization check on a REST API read route allows retrieval of feed rules, filters, and field mappings - internal merchandising logic that store operators typically treat as proprietary business configuration. Additionally, the full product category taxonomy can be enumerated, enabling competitive intelligence gathering. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability despite the straightforward unauthenticated attack vector.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.
SQL injection in the Paymob for WooCommerce WordPress plugin (versions before 4.1.9) allows unauthenticated remote attackers to read arbitrary data from the WordPress database - including user credentials and application secrets - by submitting a crafted payment callback request. The critical design flaw is that the unsanitized client-supplied identifier is passed directly into a SQL query before the plugin validates the payment provider's HMAC signature, entirely bypassing the intended authentication gate. Both in-band (reflected) and time-based blind extraction techniques are viable, maximizing attacker flexibility. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, though the unauthenticated, low-complexity attack vector makes this a high-priority patching target for any site running this plugin.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack profile is inherently accessible to any opportunistic actor who can reach the WordPress installation.
Unauthenticated SSRF in the Gutenverse Companion WordPress plugin (all versions through 2.5.1) allows remote unauthenticated attackers to induce the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a changed scope (S:C) in its CVSS vector, indicating potential for pivoting from the WordPress application layer to backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier makes this broadly exploitable against any unpatched WordPress installation running this plugin.
Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the Directories Pro WordPress plugin (versions <= 2.0.5) allows a subscriber-level authenticated user to gain higher-level privileges within the WordPress installation. Reported by Patchstack and classified under CWE-266 (Incorrect Privilege Assignment), this flaw exposes sites using the plugin for directory listings to unauthorized data access and content manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface warrants prompt patching.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact.
Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source.
Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
SQL injection in the Everest Backup WordPress plugin (versions up to and including 2.3.12) lets remote attackers inject arbitrary SQL through an unauthenticated request, per a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and a base score of 9.3. Reported by Patchstack, the flaw primarily exposes backend database contents (C:H) and can affect availability (A:L); no public exploit or active-exploitation evidence is identified at time of analysis. Because it requires no authentication and low complexity, any exposed site running an affected version is reachable directly over the network.
Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.
Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote, unauthenticated attacker to include arbitrary local files from the server's filesystem, potentially exposing sensitive configuration data or achieving remote code execution through chained techniques such as log poisoning. Reported by Patchstack, the flaw is classified under CWE-98, targeting PHP's include/require mechanism within the plugin. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the CVSS 8.1 score reflects a high-severity, zero-privilege-required attack path.
Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
WPMobile.App plugin for WordPress, versions 11.77 and earlier, allows unauthenticated remote attackers to bypass authorization controls and access protected resources. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects full network exploitability with high confidentiality impact and no integrity or availability consequence, consistent with an unauthorized read-access scenario. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.
Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject arbitrary SQL through an application entry point, exposing database contents. The Patchstack advisory classifies it as a 'Subscriber' SQL injection, implying low-privilege authenticated access, though the supplied CVSS vector marks it PR:N; either way the scope-changed impact (S:C) means the injected query reaches data beyond the plugin's own boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated broken access control in the Hydra Booking WordPress plugin by Themefic (versions ≤ 1.2.2) permits any remote, unauthenticated party to bypass authorization checks and interact with restricted plugin functionality. The CWE-862 root cause - missing authorization - means protected endpoints can be triggered by anonymous HTTP requests, enabling unauthorized reading, modification, or disruption of booking data. No public exploit code and no active exploitation have been confirmed at the time of analysis.
Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.
Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.
PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Web Directory Free WordPress plugin (by shamalli) through version 1.7.13 lets remote attackers inject arbitrary SQL into backend queries without any credentials or user interaction. Any unauthenticated visitor can reach the vulnerable parameter and read sensitive database contents, including WordPress user records and password hashes. No public exploit has been identified at time of analysis, but the flaw is trivially reachable (CVSS 9.3) and typical of Patchstack-reported plugin SQLi that is quickly reverse-engineered from the patch diff.
Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target.
Account takeover in the TrueBooker appointment-booking plugin for WordPress (all versions through 1.2.6) lets remote attackers hijack any account, including administrators. The add_front_user_update() AJAX action is exposed to unauthenticated visitors and trusts a caller-supplied truebooker_wp_user_id, so an attacker can rewrite an admin's email address and then use WordPress's built-in password-reset flow to seize the account. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS of 9.8.
Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in `allow_attachment_actions()` confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.
Authentication bypass in the User Profile Builder WordPress plugin (versions through 3.16.4) lets unauthenticated attackers log in as the site's Administrator (user ID 1) by submitting a registration with a 61-70 character username, resulting in full site takeover. The flaw is a PHP type-confusion bug where an error object is silently coerced to the integer 1, binding an autologin nonce to the admin account. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact defective code path.
Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.
Unauthenticated information disclosure in Product Feed PRO for WooCommerce by AdTribes (WordPress plugin) before version 13.5.7 exposes sensitive WooCommerce store configuration to any remote party without credentials. A missing authorization check on a REST API read route allows retrieval of feed rules, filters, and field mappings - internal merchandising logic that store operators typically treat as proprietary business configuration. Additionally, the full product category taxonomy can be enumerated, enabling competitive intelligence gathering. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability despite the straightforward unauthenticated attack vector.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.
SQL injection in the Paymob for WooCommerce WordPress plugin (versions before 4.1.9) allows unauthenticated remote attackers to read arbitrary data from the WordPress database - including user credentials and application secrets - by submitting a crafted payment callback request. The critical design flaw is that the unsanitized client-supplied identifier is passed directly into a SQL query before the plugin validates the payment provider's HMAC signature, entirely bypassing the intended authentication gate. Both in-band (reflected) and time-based blind extraction techniques are viable, maximizing attacker flexibility. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, though the unauthenticated, low-complexity attack vector makes this a high-priority patching target for any site running this plugin.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
SQL injection in the MailChimp For WooCommerce WordPress plugin (all versions prior to 6.2) allows authenticated administrators to submit unsanitized input through the plugin's administrative interface, triggering arbitrary database queries against the underlying WordPress database. The CVSS scope change (S:C) indicates that successful exploitation reaches beyond the plugin's own data, potentially exposing customer PII, order records, and other WooCommerce data stored in shared database tables. No public exploit has been identified at time of analysis, and exploitation is gated behind WordPress administrator-level authentication.
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack profile is inherently accessible to any opportunistic actor who can reach the WordPress installation.
Unauthenticated SSRF in the Gutenverse Companion WordPress plugin (all versions through 2.5.1) allows remote unauthenticated attackers to induce the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a changed scope (S:C) in its CVSS vector, indicating potential for pivoting from the WordPress application layer to backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier makes this broadly exploitable against any unpatched WordPress installation running this plugin.
Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the Directories Pro WordPress plugin (versions <= 2.0.5) allows a subscriber-level authenticated user to gain higher-level privileges within the WordPress installation. Reported by Patchstack and classified under CWE-266 (Incorrect Privilege Assignment), this flaw exposes sites using the plugin for directory listings to unauthorized data access and content manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface warrants prompt patching.
SQL injection in the Reviewer WordPress plugin (versions ≤ 3.14.2) by mvpthemes allows any authenticated subscriber-level user to query the underlying WordPress database over the network without user interaction. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can reach data beyond the plugin's own tables, yielding high confidentiality impact against potentially the full WordPress database. Reported by Patchstack; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact.
Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source.
Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
SQL injection in the Everest Backup WordPress plugin (versions up to and including 2.3.12) lets remote attackers inject arbitrary SQL through an unauthenticated request, per a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and a base score of 9.3. Reported by Patchstack, the flaw primarily exposes backend database contents (C:H) and can affect availability (A:L); no public exploit or active-exploitation evidence is identified at time of analysis. Because it requires no authentication and low complexity, any exposed site running an affected version is reachable directly over the network.
Unauthenticated broken access control in the Arvow AI SEO Writer WordPress plugin (versions ≤ 1.5.3) exposes unprotected endpoints that allow remote unauthenticated attackers to perform privileged write-level operations due to missing authorization checks (CWE-862). The CVSS 3.1 vector (PR:N/I:H) confirms no authentication is required and integrity impact is high, indicating attackers can modify SEO configuration, inject content, or alter plugin-managed data without any credentials. No active exploitation has been confirmed via CISA KEV, and no public proof-of-concept has been identified at time of analysis.
Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.
Broken access control in the StoreGrowth: Smart Sales Booster for WooCommerce plugin (versions <= 2.1.1) permits unauthenticated remote attackers to bypass authorization checks and perform privileged store management actions. The root cause is a missing authorization gate (CWE-862), meaning certain plugin endpoints execute sensitive operations without verifying the caller's identity or permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-friction exploitation conditions - no authentication, no user interaction, network-accessible - make this a straightforward target for opportunistic scanning.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote, unauthenticated attacker to include arbitrary local files from the server's filesystem, potentially exposing sensitive configuration data or achieving remote code execution through chained techniques such as log poisoning. Reported by Patchstack, the flaw is classified under CWE-98, targeting PHP's include/require mechanism within the plugin. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the CVSS 8.1 score reflects a high-severity, zero-privilege-required attack path.
Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.
Unauthenticated sensitive data exposure in the REST API Log WordPress plugin (versions <= 1.7.1) allows any remote actor to query the plugin's log storage and retrieve recorded REST API request and response data without credentials. Reported by Patchstack and scored CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N, the exposure is trivially reachable across the network with no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated broken access control in the MultiVendorX WordPress plugin (versions 5.0.10 and earlier) exposes restricted marketplace data to any remote attacker without credentials. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, allowing unauthenticated network requests to bypass access restrictions and retrieve sensitive information such as vendor orders, customer data, or marketplace configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward target for opportunistic scanning.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to retrieve subscriber private information without credentials or user interaction. Classified under CWE-1258, the root cause is a failure to restrict access to private user data at the plugin level, exposing information that should be gated by authentication. No public exploit code has been identified at time of analysis, though the absence of any authentication or complexity barrier makes this straightforward to abuse once the vulnerable endpoint is known.
Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
WPMobile.App plugin for WordPress, versions 11.77 and earlier, allows unauthenticated remote attackers to bypass authorization controls and access protected resources. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects full network exploitability with high confidentiality impact and no integrity or availability consequence, consistent with an unauthorized read-access scenario. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.
Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject arbitrary SQL through an application entry point, exposing database contents. The Patchstack advisory classifies it as a 'Subscriber' SQL injection, implying low-privilege authenticated access, though the supplied CVSS vector marks it PR:N; either way the scope-changed impact (S:C) means the injected query reaches data beyond the plugin's own boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated arbitrary code execution affects the WordPress plugin WP BASE Booking (of Appointments, Services and Events) in all versions up to and including 6.3.0, reported by Patchstack and classified as CWE-94 code injection. A remote attacker with no authentication can cause attacker-controlled code to execute on the hosting server, yielding full compromise of the site and its data. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS rating and unauthenticated network vector make this a high-priority patch.
Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.4) allows remote unauthenticated attackers to delete files anywhere on the server filesystem by exploiting a path traversal flaw (CWE-22), subject to a user interaction requirement. The scope-changed CVSS vector (S:C/A:H) indicates that successful exploitation reaches beyond the plugin directory, threatening WordPress core files, server configuration, or other critical resources, with potential for complete site outage. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated broken access control in the Hydra Booking WordPress plugin by Themefic (versions ≤ 1.2.2) permits any remote, unauthenticated party to bypass authorization checks and interact with restricted plugin functionality. The CWE-862 root cause - missing authorization - means protected endpoints can be triggered by anonymous HTTP requests, enabling unauthorized reading, modification, or disruption of booking data. No public exploit code and no active exploitation have been confirmed at the time of analysis.
Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.
Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.
PHP Object Injection in the Booking Activities WordPress plugin (versions ≤ 1.18.4) exposes sites to potential remote code execution through unsafe deserialization of attacker-controlled data. The CVSS vector (PR:N, UI:R) indicates exploitation requires no authentication but does require some form of user interaction, suggesting the attack surface likely involves a front-end booking form or link that a visitor triggers. Depending on available PHP class chains (POP chains) in the WordPress environment, impact can reach full confidentiality, integrity, and availability compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Web Directory Free WordPress plugin (by shamalli) through version 1.7.13 lets remote attackers inject arbitrary SQL into backend queries without any credentials or user interaction. Any unauthenticated visitor can reach the vulnerable parameter and read sensitive database contents, including WordPress user records and password hashes. No public exploit has been identified at time of analysis, but the flaw is trivially reachable (CVSS 9.3) and typical of Patchstack-reported plugin SQLi that is quickly reverse-engineered from the patch diff.
Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target.