WordPress
Monthly
Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.
Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.
SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this straightforward to exploit once the affected endpoint is identified.
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.
Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allows any authenticated Contributor-level user to supply arbitrary URLs in the Podcast Episode URL settings field, causing the server to issue unvalidated HTTP requests that can reach internal network services, cloud metadata endpoints, or other systems not directly exposed to the internet. The CVSS 7.1 score reflects high confidentiality impact against reachable internal services, and a publicly available proof-of-concept combined with a 13% EPSS score makes this an actionable priority for WordPress site operators running the plugin. No active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Arbitrary file deletion in the GeoDirectory WordPress plugin (all versions through 2.8.169) permits authenticated attackers with subscriber-level access to delete any file the web server process can reach, trivially enabling remote code execution by targeting wp-config.php. The attack exploits a query-string consistency-check bypass in the delete_revision handler, which dereferences attacker-supplied attachment metadata paths without any post-type or filesystem-path validation. No public exploit code or CISA KEV listing was identified at time of analysis, though the description is sufficiently detailed to enable independent exploit development; any site with open user registration should treat this as an immediate priority.
Arbitrary file deletion in the Formidable Digital Signatures plugin for WordPress (all versions through 3.0.6) lets unauthenticated attackers delete server files by passing an attacker-controlled path in item_meta[field_id][content] together with the delete_saved_image flag during normal anonymous form submission. Because deleting wp-config.php can force WordPress back into its setup routine, this file-deletion primitive escalates to full site takeover, which is why it carries a CVSS 9.8. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated credential theft in the InstaWP Connect WordPress migration plugin (all versions ≤ 0.1.3.6) exposes database access details and API signatures on Apache servers during active migration windows. The plugin predictably derives its AES-256-CBC decryption passphrase as SHA256(migrate_key), where the migrate_key is directly leaked in the filename of the unprotected options file via Apache directory listing - allowing an attacker who finds the file to mathematically recover the encryption key and decrypt the options payload without any brute force. Recovery of the api_signature may enable downstream remote code execution via InstaWP's service API. No public exploit or CISA KEV listing has been confirmed at time of analysis, though the deterministic key derivation significantly reduces exploitation effort.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Path traversal in the Sucuri Security WordPress plugin through version 2.7.3 allows authenticated administrators to delete arbitrary files outside the WordPress installation directory. The pageIntegritySubmission() method in src/integrity.lib.php concatenates the unsanitized sucuriscan_integrity parameter directly with ABSPATH before passing it to PHP's unlink(), enabling traversal sequences to reach sensitive files such as wp-config.php and .htaccess. A publicly available exploit exists (reported by VulnCheck); no CISA KEV listing has been confirmed, but file deletion of wp-config.php can cause immediate site outage and enable full WordPress reinstallation by a follow-on attacker.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL through an unsanitized, unescaped parameter that is reachable without authentication, enabling blind extraction of database contents such as user credentials and secrets. Reported by WPScan, it carries a CVSS of 9.1 and has publicly available exploit code, though its EPSS probability is low (0.16%, 6th percentile) and it is not listed in CISA KEV. Exploitation status: publicly available exploit code exists.
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. A publicly available exploit exists via WPScan; no confirmed active exploitation in CISA KEV, and EPSS sits at 0.21% (11th percentile), suggesting opportunistic rather than widespread automated attack activity at time of analysis.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.
Unauthenticated denial-of-service in WP Maps Pro WordPress plugin before 6.1.3 allows any remote attacker without credentials to exhaust server resources by triggering uncontrolled recursion through an exposed AJAX endpoint. The plugin fails to perform a capability check on at least one AJAX action accessible via the wp-ajax-nopriv_ hook and does not restrict the operation that action dispatches. No public exploit code has been identified at time of analysis and EPSS exploitation probability is very low (0.14%, 4th percentile), though successful exploitation can fully degrade availability of the affected WordPress installation.
WPC Order Tip for WooCommerce plugin (all versions before 3.3.1) exposes sensitive customer order data to unauthenticated remote attackers via an unprotected reporting feature that performs no authorization or nonce verification. Any unauthenticated party with network access to the WordPress store can query the endpoint and retrieve billing names, order IDs, statuses, fee amounts, and order dates for any customer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at the 4th percentile, indicating low current exploitation activity despite a high CVSS score.
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.
Full network takeover via authentication bypass in the InfiniteWP Client WordPress plugin before 1.13.6 affects WordPress Multisite installations, where the plugin fails to validate the site-connection state and the authenticity of requests to its remote-management endpoint. Unauthenticated remote attackers can bind their own management key, hijack an administrator session, and gain control of every site in the network, culminating in remote code execution. No public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) despite the maximal 9.8 CVSS, and a vendor patch is available.
Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any order as fully paid without processing a real payment, because several payment-completion endpoints trust the client-supplied completion signal instead of verifying it against the payment gateway. Any store using this plugin can be defrauded of goods, services, or digital downloads. A public exploit exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) allows remote attackers to reset the password of any account, including administrators, because a password-change action fails to verify the requester's authorization. Successful exploitation yields full admin login and therefore complete control of the WordPress site. No public exploit identified at time of analysis; the flaw was reported by Wordfence and an upstream fix is present in the plugin repository.
Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
Unauthenticated privilege escalation in the MStore API WordPress plugin (versions 4.20.0 and earlier) allows remote, unauthenticated attackers to gain elevated privileges on affected WordPress installations. Rooted in CWE-266 (Incorrect Privilege Assignment), the flaw is reachable over the network without any authentication or user interaction, though elevated attack complexity (AC:H) indicates a specific condition or race condition must be satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-impact CVSS score of 8.1 reflects the severity of a complete privilege compromise if exploited successfully.
Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.
SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Broken Access Control in the Solace Extra WordPress plugin (≤1.6.0) allows authenticated subscribers to bypass authorization checks and perform privileged plugin actions. The CVSS vector (PR:L, A:H) indicates that a low-privileged subscriber account is sufficient to trigger high-availability-impact operations, with minor integrity impact. No public exploit or active exploitation has been identified at time of analysis.
PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this straightforward to exploit once the affected endpoint is identified.
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.
Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. A publicly available exploit exists per WPScan, and the CVSS vector confirms trivial remote exploitation with no authentication, interaction, or special conditions required.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
PHP Object Injection escalating to unauthenticated remote code execution affects the WooCommerce Subscriptions WordPress plugin from version 4.7.0 up to (but not including) 9.1.0, but only on stores running WooCommerce's High-Performance Order Storage (HPOS). The plugin unserializes attacker-controlled input without validation, and a gadget chain in bundled dependencies turns that into arbitrary code execution. Publicly available exploit code exists and a vendor patch (9.1.0) is available, but this is not listed in CISA KEV; the EPSS score of 28% is elevated, indicating meaningful exploitation probability.
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attackers reset passwords, promote accounts to Administrator, or delete accounts whose user ID collides with the ID of one of the plugin's own posts. The flaw stems from the plugin overriding WordPress's own capability decisions for unrelated privileged user actions. Publicly available exploit code exists (WPScan), EPSS is a notable 15%, and SSVC rates it automatable with total technical impact, though it is not currently listed in CISA KEV.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authenticated user to manipulate raw SQL queries and tamper with booking consent records belonging to other users. The flaw arises from a user-controlled value being interpolated directly into a database query without sanitization (CWE-89), enabling both unauthorized data disclosure and integrity violations against other users' booking records. A publicly available proof-of-concept exists per WPScan's disclosure, and an EPSS score of 16% reflects meaningful exploitation likelihood, though active exploitation has not been formally confirmed in CISA's KEV catalog.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Second-order SQL injection in Form Maker by 10Web WordPress plugin (all versions before 1.15.45) allows any subscriber-level authenticated user to execute arbitrary SQL against the WordPress database by submitting crafted input to database-backed choice fields, yielding high confidentiality and integrity impact. A publicly available proof-of-concept from WPScan lowers the exploitation barrier, and an EPSS of 16% reflects above-baseline real-world risk. No active exploitation is confirmed in CISA KEV at time of analysis, though the combination of low required privilege, network accessibility, and public exploit code makes this a credible near-term threat on unpatched installations.
Financial/business-logic bypass in the Wallet for WooCommerce WordPress plugin (all versions before 1.6.10) lets a customer credit their wallet balance for less than the amount actually paid, because the plugin credits the top-up before confirming the sum the payment gateway actually collected. Any registered store customer can effectively mint store credit at a discount, causing direct monetary loss to the merchant. Publicly available exploit code exists (WPScan); the flaw is not listed in CISA KEV, and EPSS is a moderate 13%.
Server-Side Request Forgery in the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1) allows any authenticated Contributor-level user to supply arbitrary URLs in the Podcast Episode URL settings field, causing the server to issue unvalidated HTTP requests that can reach internal network services, cloud metadata endpoints, or other systems not directly exposed to the internet. The CVSS 7.1 score reflects high confidentiality impact against reachable internal services, and a publicly available proof-of-concept combined with a 13% EPSS score makes this an actionable priority for WordPress site operators running the plugin. No active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3) enables remote attackers to both exfiltrate sensitive backup archives and trigger arbitrary full-site restores that overwrite live site files and the database. WPScan disclosed a publicly available proof-of-concept exploit, and SSVC rates the attack as automatable, creating conditions for mass exploitation campaigns. The vendor-reported CVSS score of 7.5 covers only the confidentiality dimension and substantially understates real-world risk by omitting the integrity and availability destruction possible through forced site restores.
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Unauthenticated arbitrary file upload in the Giftware WordPress plugin before 4.2.10 allows remote attackers to upload PHP files through an upload path that fails to validate file type (CWE-434), leading to remote code execution on the underlying web server. The flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) and publicly available exploit code exists per WPScan, though it is not currently listed in CISA KEV; the EPSS score of 22% reflects meaningful but not top-tier near-term exploitation probability.
Unauthenticated export file disclosure in Import WP WordPress plugin (all versions before 2.14.23) allows any remote attacker to download administrator-generated export files without credentials. The export download handler performs no authorization check, exposing files that may contain user PII including email addresses, login names, and role assignments. A publicly available exploit exists (reported by WPScan), and EPSS sits at 16%, indicating meaningful real-world exploitation interest; exploitation is contingent on two prerequisites that meaningfully reduce actual exposure relative to the raw CVSS score.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. With a publicly available proof-of-concept, an EPSS of 17%, and a CVSS of 8.8, this is a high-priority patch for any healthcare-sector WordPress deployment running this plugin - though no CISA KEV-confirmed active exploitation has been identified at time of analysis.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Authentication bypass in the VentraConnect Social Login WordPress plugin (all versions ≤ 1.4.3) allows unauthenticated attackers to fully hijack any existing WordPress account - including administrators - by weaponizing Spotify's unverified email field. The plugin's Generic::normalize_common() blindly copies the email value returned by Spotify's /v1/me API endpoint into the normalized user profile, and User_Links::link_or_login_user() then matches that value against WordPress accounts via get_user_by('email') and issues a persistent session cookie via wp_set_auth_cookie() without any email-verified assertion, mailbox challenge, or approval step. No public exploit has been identified at time of analysis, but the attack surface is fully network-accessible, requires no victim interaction, and yields complete site compromise; CVSS rates this 8.1 High with AC:H reflecting the prerequisite of a controlled Spotify account bearing the target's email address.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Arbitrary file deletion in the GeoDirectory WordPress plugin (all versions through 2.8.169) permits authenticated attackers with subscriber-level access to delete any file the web server process can reach, trivially enabling remote code execution by targeting wp-config.php. The attack exploits a query-string consistency-check bypass in the delete_revision handler, which dereferences attacker-supplied attachment metadata paths without any post-type or filesystem-path validation. No public exploit code or CISA KEV listing was identified at time of analysis, though the description is sufficiently detailed to enable independent exploit development; any site with open user registration should treat this as an immediate priority.
Arbitrary file deletion in the Formidable Digital Signatures plugin for WordPress (all versions through 3.0.6) lets unauthenticated attackers delete server files by passing an attacker-controlled path in item_meta[field_id][content] together with the delete_saved_image flag during normal anonymous form submission. Because deleting wp-config.php can force WordPress back into its setup routine, this file-deletion primitive escalates to full site takeover, which is why it carries a CVSS 9.8. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated credential theft in the InstaWP Connect WordPress migration plugin (all versions ≤ 0.1.3.6) exposes database access details and API signatures on Apache servers during active migration windows. The plugin predictably derives its AES-256-CBC decryption passphrase as SHA256(migrate_key), where the migrate_key is directly leaked in the filename of the unprotected options file via Apache directory listing - allowing an attacker who finds the file to mathematically recover the encryption key and decrypt the options payload without any brute force. Recovery of the api_signature may enable downstream remote code execution via InstaWP's service API. No public exploit or CISA KEV listing has been confirmed at time of analysis, though the deterministic key derivation significantly reduces exploitation effort.
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Path traversal in the Sucuri Security WordPress plugin through version 2.7.3 allows authenticated administrators to delete arbitrary files outside the WordPress installation directory. The pageIntegritySubmission() method in src/integrity.lib.php concatenates the unsanitized sucuriscan_integrity parameter directly with ABSPATH before passing it to PHP's unlink(), enabling traversal sequences to reach sensitive files such as wp-config.php and .htaccess. A publicly available exploit exists (reported by VulnCheck); no CISA KEV listing has been confirmed, but file deletion of wp-config.php can cause immediate site outage and enable full WordPress reinstallation by a follow-on attacker.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL through an unsanitized, unescaped parameter that is reachable without authentication, enabling blind extraction of database contents such as user credentials and secrets. Reported by WPScan, it carries a CVSS of 9.1 and has publicly available exploit code, though its EPSS probability is low (0.16%, 6th percentile) and it is not listed in CISA KEV. Exploitation status: publicly available exploit code exists.
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. A publicly available exploit exists via WPScan; no confirmed active exploitation in CISA KEV, and EPSS sits at 0.21% (11th percentile), suggesting opportunistic rather than widespread automated attack activity at time of analysis.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.
Unauthenticated denial-of-service in WP Maps Pro WordPress plugin before 6.1.3 allows any remote attacker without credentials to exhaust server resources by triggering uncontrolled recursion through an exposed AJAX endpoint. The plugin fails to perform a capability check on at least one AJAX action accessible via the wp-ajax-nopriv_ hook and does not restrict the operation that action dispatches. No public exploit code has been identified at time of analysis and EPSS exploitation probability is very low (0.14%, 4th percentile), though successful exploitation can fully degrade availability of the affected WordPress installation.
WPC Order Tip for WooCommerce plugin (all versions before 3.3.1) exposes sensitive customer order data to unauthenticated remote attackers via an unprotected reporting feature that performs no authorization or nonce verification. Any unauthenticated party with network access to the WordPress store can query the endpoint and retrieve billing names, order IDs, statuses, fee amounts, and order dates for any customer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at the 4th percentile, indicating low current exploitation activity despite a high CVSS score.
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.
Full network takeover via authentication bypass in the InfiniteWP Client WordPress plugin before 1.13.6 affects WordPress Multisite installations, where the plugin fails to validate the site-connection state and the authenticity of requests to its remote-management endpoint. Unauthenticated remote attackers can bind their own management key, hijack an administrator session, and gain control of every site in the network, culminating in remote code execution. No public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) despite the maximal 9.8 CVSS, and a vendor patch is available.
Unauthenticated privilege escalation to full site takeover in the AI Copilot - Content Generator plugin for WordPress (all versions through 1.5.6) lets remote attackers create an administrator account by saving and executing a malicious workflow whose wp_create_user action node specifies role=administrator. The plugin's only authorization barrier is a waic-nonce that is publicly emitted into frontend JavaScript (WAIC_DATA.waicNonce) on any page rendering the [aiwu-form] shortcode or public chatbot, so the nonce check provides no real protection. Reported by Wordfence with CVSS 9.8; no public exploit identified at time of analysis, but exploitation is trivial once the shortcode or chatbot is on a public page.
Privilege escalation in the Solace Extra WordPress plugin (versions before 1.6.1) allows any authenticated user with Subscriber-level access to modify site-wide presentation settings and permanently delete imported site-builder content by exploiting missing capability checks across multiple AJAX endpoints. The plugin incorrectly exposes nonce values on admin-accessible pages that low-privileged users can reach, collapsing the intended authorization boundary between Subscriber and Administrator roles. A publicly available proof-of-concept exists via WPScan; no public exploit identified at time of analysis has been confirmed by CISA KEV, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability to date.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any order as fully paid without processing a real payment, because several payment-completion endpoints trust the client-supplied completion signal instead of verifying it against the payment gateway. Any store using this plugin can be defrauded of goods, services, or digital downloads. A public exploit exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) allows remote attackers to reset the password of any account, including administrators, because a password-change action fails to verify the requester's authorization. Successful exploitation yields full admin login and therefore complete control of the WordPress site. No public exploit identified at time of analysis; the flaw was reported by Wordfence and an upstream fix is present in the plugin repository.