WordPress
Monthly
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Unlimited OTP brute-force in the miniOrange 2FA WordPress plugin before 6.2.8 allows a network attacker who already possesses a target user's password to bypass two-factor authentication entirely and achieve full account takeover. The flaw lies in rate-limit tracking being anchored to a client-supplied identifier that is reissued on every login attempt, meaning the attempt counter resets on demand and never accumulates. No public exploit has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, the impact is total authentication bypass for any account protected by the plugin.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Payment bypass in the Payment Plugins for PayPal WooCommerce WordPress plugin (versions before 2.0.20) allows unauthenticated attackers to complete purchases without initiating an actual PayPal payment transaction. A missing authorization check on a REST endpoint means any unauthenticated HTTP client can trigger order completion, resulting in goods or services being fulfilled with no payment collected. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially automatable against any internet-facing WooCommerce store running the affected plugin.
Payment bypass in Payment Gateway for Redsys & WooCommerce Lite before version 7.0.2 allows unauthenticated remote attackers to complete WooCommerce orders without actual payment by forging payment-provider callback notifications. The plugin fails to cryptographically verify the authenticity of inbound payment confirmations for at least one of its payment methods, meaning any actor who can reach the callback endpoint can submit a fabricated notification and have orders marked as paid. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires only network access and minimal technical skill.
Payment bypass in the 'Integrate PhonePe with WooCommerce' WordPress plugin (through version 1.2.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without making actual payment. The plugin fails on two independent validation layers: it does not bind a verified PhonePe transaction ID to the specific order being settled, and it does not authenticate the origin of payment-completion requests. An attacker with one valid transaction ID - obtained from any legitimate purchase, even a minimal-value one - can replay it against any other order on the same store. No public exploit identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.
Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Unauthenticated broken access control in BoldGrid's Total Upkeep WordPress backup plugin (versions up to and including 1.17.2) permits remote unauthenticated attackers to invoke privileged backup management functions without any authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no prerequisites beyond network reachability. The high availability impact (A:H) alongside low integrity impact (I:L) suggests attackers can delete, overwrite, or disrupt backup data, eliminating an organization's ability to recover from other incidents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Authentication bypass in the Login with Phone Number WordPress plugin (≤1.8.70) allows remote, unauthenticated attackers to circumvent the login mechanism via an authentication capture-replay technique (CWE-290), achieving full account takeover with high confidentiality, integrity, and availability impact. Exploitation carries high attack complexity (CVSS AC:H), meaning a specific race condition, token-interception window, or knowledge of a registered phone number is likely required. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is any internet-accessible WordPress site running the affected plugin.
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.
Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
PHP Object Injection in the WPBruiser {no- Captcha anti-Spam} WordPress plugin (versions ≤ 3.1.43) allows remote unauthenticated attackers to inject crafted serialized objects that are deserialized by the plugin, enabling arbitrary object instantiation and, when combined with a suitable POP gadget chain, code execution or data compromise. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reported by Patchstack (EUVD-2026-53983). No public exploit code was identified at time of analysis and it is not listed in CISA KEV, so there is no confirmed active exploitation.
Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.
Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.
PHP Object Injection in the Export User Data WordPress plugin (versions up to and including 2.2.6) allows attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. Reported by Patchstack (EUVD-2026-53980) and rated CVSS 9.8, though the Patchstack title labels it a 'Subscriber' issue, implying a low-privileged account is actually required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in Jeg Kit for Elementor (WordPress plugin, versions <= 3.2.10) allows authenticated attackers holding Author-level WordPress privileges to pass unsanitized input through PHP's deserialization mechanism, potentially triggering a Property-Oriented Programming (POP) chain present in the environment. If a suitable POP chain exists - contributed by the plugin itself, Elementor, or any co-installed dependency - the attacker can achieve remote code execution, arbitrary file manipulation, or full data disclosure on the WordPress host. No public exploit or CISA KEV listing has been identified at time of analysis, though Patchstack has formally catalogued the issue.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Sensitive subscriber data exposure in the Vimeo WordPress plugin (versions 1.2.2 and earlier) allows unauthenticated remote attackers to retrieve confidential subscriber information via network requests. Reported by Patchstack and tracked as EUVD-2026-53973, the flaw is rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin actively includes protected subscriber data in responses that should not be accessible without authorization. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.
Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.
Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Broken access control in the BOX NOW Delivery Croatia WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to access restricted plugin functionality due to missing authorization checks, exposing sensitive data with high confidentiality impact. Reported by Patchstack and tracked under EUVD-2026-53962, this flaw is exploitable over the network with no credentials or user interaction required, making it trivially accessible to any attacker who can reach a vulnerable WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Gutenberg Essential Blocks WordPress plugin before 6.4.0 exposes published content from custom post types that site administrators deliberately registered as non-public. The plugin's public REST API route queries arbitrary post types supplied by the caller without first verifying their visibility setting, bypassing the access control intent of the post type registration. A publicly available proof-of-concept exists; EPSS sits at 0.14% (4th percentile) suggesting exploitation remains rare despite automatable conditions, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated information disclosure in Gutenberg Essential Blocks for WordPress (versions before 6.4.0) exposes WooCommerce per-product lifetime sales unit counts to any internet user via an unrestricted public REST API route. The plugin over-fetches a non-public WooCommerce metric and surfaces it in the REST response without access control enforcement, meaning competitors, scrapers, or threat actors can query sales volumes for any published product on affected stores. A publicly available proof-of-concept exploit exists per WPScan, and SSVC assessment confirms the attack is automatable; however, EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation at time of analysis.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. A public POC is available via WPScan; no CISA KEV listing exists, and the EPSS score of 0.14% (4th percentile) reflects the practical constraint imposed by identifier acquisition being the dominant bottleneck.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Unlimited OTP brute-force in the miniOrange 2FA WordPress plugin before 6.2.8 allows a network attacker who already possesses a target user's password to bypass two-factor authentication entirely and achieve full account takeover. The flaw lies in rate-limit tracking being anchored to a client-supplied identifier that is reissued on every login attempt, meaning the attempt counter resets on demand and never accumulates. No public exploit has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, the impact is total authentication bypass for any account protected by the plugin.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Payment bypass in the Payment Plugins for PayPal WooCommerce WordPress plugin (versions before 2.0.20) allows unauthenticated attackers to complete purchases without initiating an actual PayPal payment transaction. A missing authorization check on a REST endpoint means any unauthenticated HTTP client can trigger order completion, resulting in goods or services being fulfilled with no payment collected. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially automatable against any internet-facing WooCommerce store running the affected plugin.
Payment bypass in Payment Gateway for Redsys & WooCommerce Lite before version 7.0.2 allows unauthenticated remote attackers to complete WooCommerce orders without actual payment by forging payment-provider callback notifications. The plugin fails to cryptographically verify the authenticity of inbound payment confirmations for at least one of its payment methods, meaning any actor who can reach the callback endpoint can submit a fabricated notification and have orders marked as paid. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires only network access and minimal technical skill.
Payment bypass in the 'Integrate PhonePe with WooCommerce' WordPress plugin (through version 1.2.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without making actual payment. The plugin fails on two independent validation layers: it does not bind a verified PhonePe transaction ID to the specific order being settled, and it does not authenticate the origin of payment-completion requests. An attacker with one valid transaction ID - obtained from any legitimate purchase, even a minimal-value one - can replay it against any other order on the same store. No public exploit identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.
Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Unauthenticated broken access control in BoldGrid's Total Upkeep WordPress backup plugin (versions up to and including 1.17.2) permits remote unauthenticated attackers to invoke privileged backup management functions without any authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no prerequisites beyond network reachability. The high availability impact (A:H) alongside low integrity impact (I:L) suggests attackers can delete, overwrite, or disrupt backup data, eliminating an organization's ability to recover from other incidents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Type Hub WordPress plugin (versions ≤ 2.0.6) lets remote attackers upload malicious files without any credentials, typically leading to remote code execution and full site compromise. The CVSS 3.1 base score is a maximum 10.0 with a changed scope (S:C), reflecting that a successful upload can pivot beyond the plugin into the underlying host. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the trivial attack complexity and lack of authentication make it an urgent patch priority.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Authentication bypass in the Login with Phone Number WordPress plugin (≤1.8.70) allows remote, unauthenticated attackers to circumvent the login mechanism via an authentication capture-replay technique (CWE-290), achieving full account takeover with high confidentiality, integrity, and availability impact. Exploitation carries high attack complexity (CVSS AC:H), meaning a specific race condition, token-interception window, or knowledge of a registered phone number is likely required. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is any internet-accessible WordPress site running the affected plugin.
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.
Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in Order Delivery Date for WooCommerce (versions ≤ 4.6.0) allows authenticated shop managers to exceed their intended role boundaries and gain elevated administrative access to the WordPress installation. Exploitation requires an existing shop manager account, confirmed by the CVSS:3.1 PR:H metric, limiting the attack surface to environments where untrusted or compromised accounts hold that role. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
PHP Object Injection in the WPBruiser {no- Captcha anti-Spam} WordPress plugin (versions ≤ 3.1.43) allows remote unauthenticated attackers to inject crafted serialized objects that are deserialized by the plugin, enabling arbitrary object instantiation and, when combined with a suitable POP gadget chain, code execution or data compromise. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is reported by Patchstack (EUVD-2026-53983). No public exploit code was identified at time of analysis and it is not listed in CISA KEV, so there is no confirmed active exploitation.
Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.
Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.
PHP Object Injection in the Export User Data WordPress plugin (versions up to and including 2.2.6) allows attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present. Reported by Patchstack (EUVD-2026-53980) and rated CVSS 9.8, though the Patchstack title labels it a 'Subscriber' issue, implying a low-privileged account is actually required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in Jeg Kit for Elementor (WordPress plugin, versions <= 3.2.10) allows authenticated attackers holding Author-level WordPress privileges to pass unsanitized input through PHP's deserialization mechanism, potentially triggering a Property-Oriented Programming (POP) chain present in the environment. If a suitable POP chain exists - contributed by the plugin itself, Elementor, or any co-installed dependency - the attacker can achieve remote code execution, arbitrary file manipulation, or full data disclosure on the WordPress host. No public exploit or CISA KEV listing has been identified at time of analysis, though Patchstack has formally catalogued the issue.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Sensitive subscriber data exposure in the Vimeo WordPress plugin (versions 1.2.2 and earlier) allows unauthenticated remote attackers to retrieve confidential subscriber information via network requests. Reported by Patchstack and tracked as EUVD-2026-53973, the flaw is rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin actively includes protected subscriber data in responses that should not be accessible without authorization. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.
Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.
Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Broken access control in the BOX NOW Delivery Croatia WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to access restricted plugin functionality due to missing authorization checks, exposing sensitive data with high confidentiality impact. Reported by Patchstack and tracked under EUVD-2026-53962, this flaw is exploitable over the network with no credentials or user interaction required, making it trivially accessible to any attacker who can reach a vulnerable WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Privilege escalation in the Kadence WooCommerce Email Designer WordPress plugin (all versions up to and including 1.5.19) lets unauthenticated remote attackers gain elevated privileges due to a missing authorization check (CWE-862). Reported by Patchstack and tracked as EUVD-2026-53939, the flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, so no login or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.
Remote attackers without any authentication can bypass authorization checks in the Simple Membership WordPress plugin (versions ≤ 4.7.8), enabling unauthorized write operations against membership-protected resources. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms exploitation requires no credentials, no user interaction, and low complexity, making this trivially scriptable at scale against any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for independent exploit development.
Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Gutenberg Essential Blocks WordPress plugin before 6.4.0 exposes published content from custom post types that site administrators deliberately registered as non-public. The plugin's public REST API route queries arbitrary post types supplied by the caller without first verifying their visibility setting, bypassing the access control intent of the post type registration. A publicly available proof-of-concept exists; EPSS sits at 0.14% (4th percentile) suggesting exploitation remains rare despite automatable conditions, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated information disclosure in Gutenberg Essential Blocks for WordPress (versions before 6.4.0) exposes WooCommerce per-product lifetime sales unit counts to any internet user via an unrestricted public REST API route. The plugin over-fetches a non-public WooCommerce metric and surfaces it in the REST response without access control enforcement, meaning competitors, scrapers, or threat actors can query sales volumes for any published product on affected stores. A publicly available proof-of-concept exploit exists per WPScan, and SSVC assessment confirms the attack is automatable; however, EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation at time of analysis.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Unauthenticated license-key erasure and premium deactivation is possible in the Checkimate WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through version 1.0.13. The plugin's license-management endpoint relies on a shared secret computed exclusively from publicly available site information - an authentication bypass that renders the access control trivially circumventable. Any remote attacker who can reach the WordPress site can permanently erase the stored license key and strip the installation of its paid premium status; a public proof-of-concept exists (reported by WPScan), though EPSS remains low at 0.14%, indicating opportunistic rather than widespread exploitation at time of analysis.
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily stored file uploads without any authorization check, enabling an attacker who has obtained a victim's high-entropy temporary upload identifier to retrieve that user's in-progress file submission. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the flaw represents a missing permission_callback on a WordPress REST route - effectively an IDOR variant against ephemeral upload objects. A public POC is available via WPScan; no CISA KEV listing exists, and the EPSS score of 0.14% (4th percentile) reflects the practical constraint imposed by identifier acquisition being the dominant bottleneck.
Payment amount manipulation in Stripe Payment Forms by WP Full Pay (WordPress plugin) before version 8.5.2 allows any unauthenticated visitor to arbitrarily lower - or potentially zero-out - the price of a Stripe payment intent before checkout completes. The flaw stems from an incomplete authorization fix in 8.5.0 that patched only one of the two vulnerable AJAX handlers, leaving the pricing-recalculation and payment-intent-update endpoints exposed. A publicly available proof-of-concept exists, and SSVC analysis confirms the vulnerability is automatable, raising the practical risk above what the low EPSS score (0.13%, 3rd percentile) alone would suggest.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
Unauthenticated arbitrary file deletion in the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin (all versions before 1.1.8) lets anonymous attackers destroy customer order attachments staged in the plugin's upload directory. The plugin's only access control on its deletion routine is a nonce, but that nonce can be freely obtained by unauthenticated visitors, defeating the check entirely. Publicly available exploit code exists and a vendor patch has been released; EPSS is low (0.14%) and the issue is not in CISA KEV.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.