WordPress
Monthly
An authorization bypass in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin, affecting all versions up to and including 7.9.6, lets any logged-in user at subscriber level or above delete arbitrary attachments from the WordPress Media Library. The action handler fails to verify that the caller is permitted to remove the targeted attachment, so a low-privilege account - which many WooCommerce storefronts allow anyone to self-register for - is sufficient to destroy site media content. The vendor addressed the flaw in version 7.9.7; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, though the assessed EPSS-style risk is driven by how commonly subscriber registration is left open on commerce sites.
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.
Missing authorization in the Skydropx WordPress plugin (versions through 2.1.4) allows unauthenticated remote attackers to bypass access controls, potentially disclosing sensitive data with high confidentiality impact and limited integrity impact. The flaw is remotely exploitable with low complexity and requires no privileges or user interaction. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Reflected cross-site scripting (XSS) in the SimplyRETS Real Estate IDX WordPress plugin (versions up to and including 3.2.9) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when they click a crafted link. The vulnerability requires user interaction (UI:R) and is non-persistent; no public exploit code or active exploitation has been identified at time of analysis. The specific vulnerable parameter is not named in the advisory, but the issue is a CWE-79 improper neutralization flaw.
Code injection in the VillaTheme Salevo WooCommerce plugin for WordPress (woo-boost-sales) affects all releases through 1.3.0 and lets a remote attacker reach a code-generation sink within the plugin, with the assessor's scoring indicating high impact to confidentiality, integrity and availability. The underlying vulnerability class is CWE-94 (Improper Control of Generation of Code), and the Patchstack advisory tags the issue as potential remote code execution; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis. Exploitation requires the plugin to be installed and active on a WooCommerce site, which meaningfully narrows the realistic attack surface; the exact vulnerable function, endpoint or parameter is not disclosed, and the published CVSS vector (PR:N) conflicts with the assessor's vector (PR:L), so the precise authentication precondition is not fully resolved from available data.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Session hijacking in the VideoWhisper Broadcast Live Video WordPress plugin (up to version 7.3.2) is enabled by a session fixation flaw (CWE-384), allowing remote attackers to take over authenticated sessions, but only if a victim logs in while an attacker-controlled session ID is active (UI:R per independent assessment). No public exploit code exists and no active exploitation is confirmed (not in CISA KEV). The published CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates the required user interaction and availability impact; the assessed vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
PHP object injection in the Polylang WordPress translation plugin through version 3.8.9 lets an authenticated high-privileged user (CVSS PR:H, typically a WordPress administrator) feed untrusted serialized data into a PHP unserialize() call, which can corrupt application state and, if a usable POP gadget chain exists in WordPress core, Polylang, or another installed component, escalate to code execution or file manipulation. There is no public exploit code identified at time of analysis and no indication of active exploitation (not CISA KEV), so practical risk is currently gated by the administrator-equivalent access requirement rather than by exploitability of the deserialization primitive alone.
Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Code injection in the VillaTheme 'Email Template Customizer for WooCommerce' WordPress plugin, affecting versions up to and including 1.3.4, lets an attacker influence the content/code generated by the plugin's email template handling, carrying a high confidentiality impact (C:H) with low integrity impact in our assessment. The supplied advisory vector claims unauthenticated, no-interaction exploitation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but our independent assessment revises this to PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a privilege prerequisite cannot be ruled out and the unauthenticated claim is unverified. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exposure is limited to WordPress sites running WooCommerce with this specific plugin active.
Reflected cross-site scripting (CWE-79) in the VideoWhisper 'Paid Videochat Turnkey Site' WordPress plugin (ppv-live-webcams) affects all versions through 7.5.12 and lets an unauthenticated attacker inject script into a reflected parameter that executes in the browser of a victim who clicks a crafted link. The attack is not self-triggering: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no attacker authentication is needed but a victim must be socially engineered into following the malicious URL while logged in to a site running the plugin, and impact scales with the victim's privileges (an administrator click enables higher-value session abuse). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no EPSS score was provided; the Patchstack advisory remains the single reference.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.
Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Stored cross-site scripting in the NewStatPress WordPress plugin (versions up to and including 1.4.5) lets unauthenticated attackers plant script payloads through the visitor-supplied query string that the plugin automatically logs into its statistics table. The payload is rendered unescaped inside a single-quoted href attribute in the 'Last referrers' meta box on the plugin's Overview admin page, so it executes only when a high-privileged user - typically an administrator - opens that page and hovers the injected link. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is assessed as a moderate-priority issue given the mandatory admin interaction and the reliance on an administrator eventually reviewing referrer statistics.
Stored cross-site scripting in the NewStatPress WordPress plugin (all versions through 1.4.5) allows unauthenticated attackers to plant arbitrary JavaScript that later executes in the browsers of visitors viewing a page that renders the plugin's 'Top Pages' output. The injected payload arrives through the QUERY_STRING/REQUEST_URI value of a crafted request, which the plugin records and later reflects without sanitization or output escaping. Exploitation is gated rather than trivial: an administrator must have published the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and the attacker's crafted URL must accumulate enough hits to enter the plugin's top-N ranking before anything is displayed - a condition reflected in the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N), which lowers complexity confidence from the reported 7.2 HIGH to account for those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Stored cross-site scripting (XSS) in the Verified Reviews (Avis Vérifiés) WordPress plugin up to version 2.4.6 allows unauthenticated attackers to inject arbitrary web scripts via the 'moderation' parameter, which execute when a user views an affected page. The plugin's ntav_check_data() function uses loose '!=' comparisons, enabling signature verification bypass by sending a JSON body with boolean true for idWebsite and sign. No public exploit identified at time of analysis; CVSS 3.1 score is 7.2 (HIGH).
Stored cross-site scripting in the Cryptocurrency Donation Box plugin for WordPress (all versions up to and including 2.2.13) allows unauthenticated attackers to persist arbitrary JavaScript via the data_object parameter of the cdbbc_payment_verify AJAX action, which executes whenever a user opens an injected page. The plugin registers that AJAX action under wp_ajax_nopriv_ and its only gate is a nonce that is publicly exposed to anonymous visitors inside the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, so exploitation needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, score 7.2) and no non-default configuration - any site publishing the shortcode is exposed. Impact is gated on the second-order step: the injected script fires when a logged-in user, typically an administrator, views the plugin's donation list table in wp-admin. No public exploit code or confirmed active exploitation is identified at time of analysis, and the practical exposure is limited to sites running this niche plugin.
Stored cross-site scripting in the Document Gallery plugin for WordPress (all versions up to and including 5.1.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into the plugin's thumber webhook action request body, which is later rendered unsanitized in the plugin's administrative logging view and executes in the browser of any user who opens the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) makes this look like a high-priority unauthenticated XSS, but exploitation has a real prerequisite: logging must be enabled in the plugin's Advanced settings, which is only the default when WP_DEBUG is true, so an administrator on a normal production site must have manually turned logging on - default installations are not affected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is confirmed in the available data.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the AnyComment WordPress plugin (all versions up to and including 0.3.6) allows unauthenticated attackers to submit a crafted 'email' value to the public /wp-json/anycomment/v1/subscribe REST endpoint, which is then stored and later rendered unescaped into an HTML table cell on the AnyComment Subscriptions admin screen. The payload fires only when an administrator subsequently opens AnyComment → Subscriptions, so the affected audience is limited to authenticated dashboard users rather than the public comment stream; scoped impact per the assessed vector is limited confidentiality and integrity (C:L/I:L) with a scope change (S:C). No public exploit code was identified at time of analysis, and exploitation requires the specific precondition that the stored subscription's user_ID does not resolve to an existing WP_User, which is the code path that bypasses escaping.
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting (XSS) in the AcyMailing WordPress plugin (versions up to and including 11.1.0) allows unauthenticated attackers to inject malicious scripts via the customField[] parameter of the public frontusers::subscribe endpoint. The injected script executes when a victim accesses the online-archive URL for the poisoned subscriber, potentially including administrators who click a plugin-generated link in the Subscribers → History screen. No public exploit code has been identified at time of analysis.
Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.
Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Reflected cross-site scripting in the Subscribe to Comments WordPress plugin (all versions before 2.3.3) allows remote attackers to inject script through a crafted URL whose parameter is reflected unvalidated into a link target, executing in the browser of anyone who clicks it, including logged-in administrators. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attacker needs no authentication (PR:N), but exploitation is gated by mandatory user interaction (UI:R) and is confined to a single victim's browser session per click - it is reflected, not stored, and does not compromise the server. Publicly available exploit code exists, the vendor has released a patched version (2.3.3), and the issue is not listed in CISA KEV, so confirmed active exploitation is not established; risk is moderate and user-interaction-gated rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
An authorization bypass in the Checkout Field Manager (Checkout Manager) for WooCommerce plugin, affecting all versions up to and including 7.9.6, lets any logged-in user at subscriber level or above delete arbitrary attachments from the WordPress Media Library. The action handler fails to verify that the caller is permitted to remove the targeted attachment, so a low-privilege account - which many WooCommerce storefronts allow anyone to self-register for - is sufficient to destroy site media content. The vendor addressed the flaw in version 7.9.7; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, though the assessed EPSS-style risk is driven by how commonly subscriber registration is left open on commerce sites.
Unauthenticated arbitrary file upload in the 10Web Booster WordPress plugin (tenweb-speed-optimizer) in all versions up to and including 2.34.10 allows remote attackers to place executable files on a target site, leading to remote code execution. The compressCustom REST endpoint fails to validate file type or extension on the page_id parameter, and the authentication check is bypassed because the plugin's tenwebio_rest nonce is written to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses - a nonce minted in a cron/loopback context with user ID 0, so it is accepted for unauthenticated visitors. Our independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (below the 9.8 base published elsewhere) because exploitation is conditional on the site having previously paused a bulk optimisation batch and on the uploaded file landing in a PHP-executable, web-accessible path; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.
Missing authorization in the Skydropx WordPress plugin (versions through 2.1.4) allows unauthenticated remote attackers to bypass access controls, potentially disclosing sensitive data with high confidentiality impact and limited integrity impact. The flaw is remotely exploitable with low complexity and requires no privileges or user interaction. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Reflected cross-site scripting (XSS) in the SimplyRETS Real Estate IDX WordPress plugin (versions up to and including 3.2.9) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when they click a crafted link. The vulnerability requires user interaction (UI:R) and is non-persistent; no public exploit code or active exploitation has been identified at time of analysis. The specific vulnerable parameter is not named in the advisory, but the issue is a CWE-79 improper neutralization flaw.
Code injection in the VillaTheme Salevo WooCommerce plugin for WordPress (woo-boost-sales) affects all releases through 1.3.0 and lets a remote attacker reach a code-generation sink within the plugin, with the assessor's scoring indicating high impact to confidentiality, integrity and availability. The underlying vulnerability class is CWE-94 (Improper Control of Generation of Code), and the Patchstack advisory tags the issue as potential remote code execution; there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis. Exploitation requires the plugin to be installed and active on a WooCommerce site, which meaningfully narrows the realistic attack surface; the exact vulnerable function, endpoint or parameter is not disclosed, and the published CVSS vector (PR:N) conflicts with the assessor's vector (PR:L), so the precise authentication precondition is not fully resolved from available data.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Missing authorization in the VideoWhisper Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin, in all versions through 7.5.12, lets unauthenticated remote attackers invoke plugin functionality that should be gated behind an access-control check, rated CVSS 3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The accessible functionality yields only low confidentiality, integrity and availability impact rather than full site compromise, and real-world exposure is bounded by the narrow install base of this specialized pay-per-view videochat plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the itthinx Affiliates WordPress plugin (all versions through 7.0.1) allows remote, unauthenticated attackers to reach a code path that deserializes attacker-controlled input via unserialize(), which can lead to full object injection against the affected site. The supplied CVSS 3.1 vector scores it 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), while our independent assessment applies AC:H because meaningful exploitation depends on the presence of a usable PHP POP gadget chain in the plugin, WordPress core, or another installed plugin/theme; without such a chain the practical effect is usually limited. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but sites running Affiliates 7.0.1 or earlier alongside components that expose gadget chains face materially elevated risk.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Session hijacking in the VideoWhisper Broadcast Live Video WordPress plugin (up to version 7.3.2) is enabled by a session fixation flaw (CWE-384), allowing remote attackers to take over authenticated sessions, but only if a victim logs in while an attacker-controlled session ID is active (UI:R per independent assessment). No public exploit code exists and no active exploitation is confirmed (not in CISA KEV). The published CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates the required user interaction and availability impact; the assessed vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
PHP object injection in the Polylang WordPress translation plugin through version 3.8.9 lets an authenticated high-privileged user (CVSS PR:H, typically a WordPress administrator) feed untrusted serialized data into a PHP unserialize() call, which can corrupt application state and, if a usable POP gadget chain exists in WordPress core, Polylang, or another installed component, escalate to code execution or file manipulation. There is no public exploit code identified at time of analysis and no indication of active exploitation (not CISA KEV), so practical risk is currently gated by the administrator-equivalent access requirement rather than by exploitability of the deserialization primitive alone.
Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Code injection in the VillaTheme 'Email Template Customizer for WooCommerce' WordPress plugin, affecting versions up to and including 1.3.4, lets an attacker influence the content/code generated by the plugin's email template handling, carrying a high confidentiality impact (C:H) with low integrity impact in our assessment. The supplied advisory vector claims unauthenticated, no-interaction exploitation (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but our independent assessment revises this to PR:L (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a privilege prerequisite cannot be ruled out and the unauthenticated claim is unverified. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exposure is limited to WordPress sites running WooCommerce with this specific plugin active.
Reflected cross-site scripting (CWE-79) in the VideoWhisper 'Paid Videochat Turnkey Site' WordPress plugin (ppv-live-webcams) affects all versions through 7.5.12 and lets an unauthenticated attacker inject script into a reflected parameter that executes in the browser of a victim who clicks a crafted link. The attack is not self-triggering: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no attacker authentication is needed but a victim must be socially engineered into following the malicious URL while logged in to a site running the plugin, and impact scales with the victim's privileges (an administrator click enables higher-value session abuse). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no EPSS score was provided; the Patchstack advisory remains the single reference.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Unauthenticated privilege escalation in the SimpleForm WordPress plugin up to and including version 3.10.0 allows any remote visitor to create an Administrator-level WordPress account by submitting crafted registration data. The vulnerable AJAX action wp_ajax_nopriv_simpleform_wp_register lacks a capability check for role assignment, and related meta-saving logic fails to exclude wp_capabilities, while the required nonce is publicly emitted on every front-end page. No public exploit code is confirmed at time of analysis, but the flaw is trivially exploitable against default configurations; an upstream fix exists via changeset 3726513, though a tagged release is not independently confirmed.
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.
Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (versions up to and including 5.7.3) lets any remote attacker read other customers' appointment records and pending cart contents by supplying sequential booking[id] and cart[id] values to the public steps__reload_booking_form_summary_panel and steps__start routes, which are reachable without login through wp_ajax_nopriv_latepoint_route_call. No ownership check is applied to those identifiers, so enumeration is trivial and requires no authentication, no user interaction and no special configuration beyond having the plugin active with live booking or cart data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) confirms remote unauthenticated exploitation with confidentiality-only impact, and the readiness of sequential integer keys makes the practical barrier to exploitation very low. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and EPSS data was not available in the supplied intelligence; the assessment is that this is a genuine, easily reproducible read-only disclosure rather than an inflated high-severity score.
Customer account takeover in the Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through 5.7.2 is possible on sites that enable the 'Use WordPress users as customers' option: an authenticated Subscriber-level attacker whose own user_login equals a victim customer's email address causes their WordPress user ID to be linked into that victim's LatePoint customer row, exposing the victim's bookings, services, agents and calendar data and overwriting the victim's email address the next time the victim logs in. Exploitation is tightly conditional - it requires the opt-in WordPress-user integration, a Subscriber account (commonly obtainable when open registration is enabled), and prior knowledge of the target's email address, so the attack is per-victim and targeted rather than mass-exploitable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided in the source data. The flaw has been assigned CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and a fix appears to have shipped in the 5.7.3 release.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Stored cross-site scripting in the NewStatPress WordPress plugin (versions up to and including 1.4.5) lets unauthenticated attackers plant script payloads through the visitor-supplied query string that the plugin automatically logs into its statistics table. The payload is rendered unescaped inside a single-quoted href attribute in the 'Last referrers' meta box on the plugin's Overview admin page, so it executes only when a high-privileged user - typically an administrator - opens that page and hovers the injected link. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is assessed as a moderate-priority issue given the mandatory admin interaction and the reliance on an administrator eventually reviewing referrer statistics.
Stored cross-site scripting in the NewStatPress WordPress plugin (all versions through 1.4.5) allows unauthenticated attackers to plant arbitrary JavaScript that later executes in the browsers of visitors viewing a page that renders the plugin's 'Top Pages' output. The injected payload arrives through the QUERY_STRING/REQUEST_URI value of a crafted request, which the plugin records and later reflects without sanitization or output escaping. Exploitation is gated rather than trivial: an administrator must have published the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and the attacker's crafted URL must accumulate enough hits to enter the plugin's top-N ranking before anything is displayed - a condition reflected in the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N), which lowers complexity confidence from the reported 7.2 HIGH to account for those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the WordPress plugin Smart Forms - When You Need More Than Just a Contact Form (all versions up to and including 2.6.104) lets unauthenticated attackers inject arbitrary JavaScript through the 'formString' parameter, which is persisted and later executed in the browser of any user, typically an administrator, who views the affected page or the form-entries listing. The nonce and authentication check on the rednao_smart_forms_save_form_values AJAX handler is enforced only when the non-default smart_forms_block_anonymous_submissions option is enabled, so default installations accept and store malicious payloads from anyone with network access. No public exploit code has been identified at time of analysis, but the unauthenticated access path, low attack complexity, and scope-changing admin-context execution make this an elevated-priority issue for affected sites; impact still depends on a privileged user subsequently rendering the stored payload.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Stored cross-site scripting (XSS) in the Verified Reviews (Avis Vérifiés) WordPress plugin up to version 2.4.6 allows unauthenticated attackers to inject arbitrary web scripts via the 'moderation' parameter, which execute when a user views an affected page. The plugin's ntav_check_data() function uses loose '!=' comparisons, enabling signature verification bypass by sending a JSON body with boolean true for idWebsite and sign. No public exploit identified at time of analysis; CVSS 3.1 score is 7.2 (HIGH).
Stored cross-site scripting in the Cryptocurrency Donation Box plugin for WordPress (all versions up to and including 2.2.13) allows unauthenticated attackers to persist arbitrary JavaScript via the data_object parameter of the cdbbc_payment_verify AJAX action, which executes whenever a user opens an injected page. The plugin registers that AJAX action under wp_ajax_nopriv_ and its only gate is a nonce that is publicly exposed to anonymous visitors inside the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, so exploitation needs no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, score 7.2) and no non-default configuration - any site publishing the shortcode is exposed. Impact is gated on the second-order step: the injected script fires when a logged-in user, typically an administrator, views the plugin's donation list table in wp-admin. No public exploit code or confirmed active exploitation is identified at time of analysis, and the practical exposure is limited to sites running this niche plugin.
Stored cross-site scripting in the Document Gallery plugin for WordPress (all versions up to and including 5.1.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into the plugin's thumber webhook action request body, which is later rendered unsanitized in the plugin's administrative logging view and executes in the browser of any user who opens the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) makes this look like a high-priority unauthenticated XSS, but exploitation has a real prerequisite: logging must be enabled in the plugin's Advanced settings, which is only the default when WP_DEBUG is true, so an administrator on a normal production site must have manually turned logging on - default installations are not affected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is confirmed in the available data.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the AnyComment WordPress plugin (all versions up to and including 0.3.6) allows unauthenticated attackers to submit a crafted 'email' value to the public /wp-json/anycomment/v1/subscribe REST endpoint, which is then stored and later rendered unescaped into an HTML table cell on the AnyComment Subscriptions admin screen. The payload fires only when an administrator subsequently opens AnyComment → Subscriptions, so the affected audience is limited to authenticated dashboard users rather than the public comment stream; scoped impact per the assessed vector is limited confidentiality and integrity (C:L/I:L) with a scope change (S:C). No public exploit code was identified at time of analysis, and exploitation requires the specific precondition that the stored subscription's user_ID does not resolve to an existing WP_User, which is the code path that bypasses escaping.
Unauthenticated account takeover in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows any remote attacker to forge a cart-recovery token and force WordPress to authenticate them as an arbitrary user, including administrators, via wp_set_auth_cookie(). The flaw combines MAC-free AES-CTR token encryption with a keystream-recovery attack, an HMAC nonce check that is skipped entirely when the wcap_nonce parameter is omitted, and a missing ownership check between the decrypted abandoned_id and the attacker-supplied user_email. Exploitation requires the attacker to have one legitimate cart-recovery link of their own plus a victim who has previously abandoned a cart, and because the auto-login feature is enabled by default and force-enabled on upgrade, default installations are exposed; no public exploit code has been identified at time of analysis, but the assessed risk is high and no CISA KEV entry is associated with this issue.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Privilege escalation in the Membership & User Roles for WooCommerce (Automatic Role Changer) plugin through version 20260828 lets an authenticated subscriber-level user re-acquire a previously revoked Administrator role and take full administrative control of the WordPress site. The flaw is reachable when the plugin is configured in Replace Roles mode and the attacker's account previously legitimately held Administrator while the plugin was active, because that role stays cached in the dfxwcrc_foreign_roles user meta and is re-applied whenever a role-assignment event fires, such as completing a purchase for a role-mapped product. Wordfence reported the issue (CVSS 7.5, CWE-269) and no public exploit code was identified at the time of analysis; the stacked preconditions - former legitimate admin, stale cache, Replace Roles mode - materially limit real-world exploitation, and only former privileged users, not arbitrary subscribers, can abuse it.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Bit Integrations - Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress (all versions up to and including 2.10.6) allows unauthenticated attackers to overwrite an administrator's password and take over the admin account. The plugin stores raw, attacker-controlled field values - including user_pass and user_email - verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and when an administrator clicks 'Re-execute' on the resulting failure log row, the stored payload is replayed inside that administrator's session and written to the administrator's own user record. Exploitation is not automatic: it requires a non-default configuration in which an administrator has mapped a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, plus the manual Re-execute click (CVSS 3.1 AV:N/AC:H/PR:N/UI:R), so an anonymous remote attacker can plant the payload but cannot complete the escalation alone; no public exploit code was identified at time of analysis.
Unauthenticated PII disclosure in the Booking Package WordPress plugin through version 1.7.29 lets remote attackers retrieve the booking_package_booked_customers table, exposing customer names, email addresses, phone numbers, physical addresses, and cancellation tokens. The endpoint's only nominal protection is a nonce that the plugin emits in the public booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, so any visitor can harvest it and call the unauthorized retrieval path; no authentication, user interaction, or special configuration is required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No CISA KEV listing was provided, and no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (I:N/A:N), making this an actionable priority for sites actively using the plugin but not a top-tier emergency.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
Stored cross-site scripting in the WordPress plugin Bit Integrations (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) through version 2.10.6 lets unauthenticated remote attackers inject arbitrary JavaScript that executes for any user viewing the affected notification page, but only after a site administrator has bound a public Bit Assist webhook trigger to a BuddyBoss 'Send Notification' action, mapped an attacker-controllable form field to the notification_content parameter, and the attacker knows the flow's secret UUID callback URL. Because of those non-default configuration prerequisites the realistic exploitability is materially lower than the raw 7.2 base score suggests, which is why the authoritative assessment rates attack complexity as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than Low. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting (XSS) in the AcyMailing WordPress plugin (versions up to and including 11.1.0) allows unauthenticated attackers to inject malicious scripts via the customField[] parameter of the public frontusers::subscribe endpoint. The injected script executes when a victim accesses the online-archive URL for the poisoned subscriber, potentially including administrators who click a plugin-generated link in the Subscribers → History screen. No public exploit code has been identified at time of analysis.
Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.
Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.
Unauthenticated file-upload handling in the Piotnet Forms WordPress plugin through 1.0.30 lets an attacker store a browser-renderable file (HTML, SVG or similar) inside the site's own origin, so that opening the file executes arbitrary JavaScript - a stored XSS condition. The storage step requires no account and no special configuration, only a publicly reachable form that exposes an upload field; execution is not self-triggering and depends on a victim, typically an administrator reviewing a submission or any user following the file's direct URL, opening the payload (UI:R), with the highest impact when that opener holds an authenticated admin session in the same origin. Publicly available exploit code exists per the WPScan disclosure, and while the vendor-classified score is 8.8, our independent assessment scores the realistic vector lower (S:C, C:L/I:L) because the write and the execution are separated by user interaction and the observable impact depends on who opens the file.
Reflected cross-site scripting in the Subscribe to Comments WordPress plugin (all versions before 2.3.3) allows remote attackers to inject script through a crafted URL whose parameter is reflected unvalidated into a link target, executing in the browser of anyone who clicks it, including logged-in administrators. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attacker needs no authentication (PR:N), but exploitation is gated by mandatory user interaction (UI:R) and is confined to a single victim's browser session per click - it is reflected, not stored, and does not compromise the server. Publicly available exploit code exists, the vendor has released a patched version (2.3.3), and the issue is not listed in CISA KEV, so confirmed active exploitation is not established; risk is moderate and user-interaction-gated rather than an emergency.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
The Disable Users WordPress plugin (versions through 1.0.5) fails to apply its account-disabling control consistently across all authentication paths, so an attacker who holds the credentials of an account an administrator has disabled can still log in and operate with that account's original privileges. Exploitation requires pre-existing valid credentials for a previously disabled account (CVSS PR:L, base score 8.8), and the regained access is bounded by the role that account held - but where the disabled user was an administrator, the result is full site compromise (C:H/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure; there is no indication of confirmed active exploitation (no CISA KEV entry in the provided data).
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.