WordPress
Monthly
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. Impact is integrity-only, with no direct data disclosure or denial of service.
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into any group through the front-end registration form, inheriting that group's configured WordPress role - up to Administrator where such a group exists. Publicly available exploit code exists (published by WPScan) and a vendor patch is available, though EPSS remains low at 0.15% (4th percentile), indicating limited observed exploitation attempts to date.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. No public exploit identified at time of analysis, but the trivial GET-based vector and 9.1 CVSS make this a high-priority integrity/availability threat.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
SQL injection in the Web Directory Free WordPress plugin up to version 1.7.13 allows unauthenticated attackers to extract sensitive database information via the 'levels' parameter. The vulnerability has a high CVSS score of 7.5, but no active exploitation (CISA KEV) or public proof-of-concept has been identified at this time.
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. No public exploit code or active exploitation is known at this time, but the high CVSS score and low attack complexity warrant prompt attention.
Unauthenticated SQL injection in the Bookly WordPress plugin permits remote extraction of database content. Attackers leverage a two-step chain—first carrying a malicious staff_ids parameter via a session-seeding AJAX call, then triggering the vulnerable query through a second endpoint—to append time-based blind SQL payloads. No public exploit code is known, but the full attack path is documented by Wordfence.
Unauthenticated SQL injection in the TrueBooker WordPress plugin allows remote attackers to extract sensitive database information. The vulnerability resides in the 'alldata[truebooker_user]' parameter and affects versions up to and including 1.2.2. Although a nonce is used, it is exposed on front-end booking pages, enabling unauthenticated exploitation if the required booking fields are present.
Unauthenticated SQL injection in the WordPress Premium Packages - Sell Digital Products Securely plugin (wpdm-premium-packages) allows any remote attacker to extract sensitive data from the website’s database. The vulnerability exists in the coupon processing REST API endpoint and stems from user input being directly interpolated into a raw SQL query without any sanitization or prepared statements.
Remote unauthenticated SQL injection in the WordPress WP Fast Total Search plugin up to version 1.80.280 allows attackers to extract sensitive database information via the 'form_data[s]' parameter. The flaw requires no authentication or user interaction, making it easily exploitable over the network. No public exploit code or active exploitation has been confirmed at this time.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unspecified vulnerability in the Falcon - WordPress Optimizations & Tweaks plugin up to version 2.10.0 allows remote, unauthenticated attackers to cause a denial of service due to improper input validation (CWE-1284). The high-severity flaw (CVSS 7.5) impacts availability with no user interaction required. No public exploit or active exploitation has been confirmed, and EPSS data is unavailable.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. Impact is integrity-only, with no direct data disclosure or denial of service.
Full account takeover in the Customer Switching WordPress plugin before 2.1.3 allows a low-privileged user, while an operator is actively switched into their account, to be resolved as that operator and switch into any permitted account including an administrator. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (4th percentile) and it is not in CISA KEV; no public exploit identified as actively used at time of analysis.
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into any group through the front-end registration form, inheriting that group's configured WordPress role - up to Administrator where such a group exists. Publicly available exploit code exists (published by WPScan) and a vendor patch is available, though EPSS remains low at 0.15% (4th percentile), indicating limited observed exploitation attempts to date.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Extra Checkout Options addon (for Extra Product Options & Add-Ons for WooCommerce) affects all WordPress installs running versions through 2.3.2, letting authenticated Subscriber-level attackers upload PHP web shells. Two flaws chain together: eco_save_settings() lacks authorization and nonce checks so a low-privileged user can add 'php' to the tc_eco_custom_file_types upload allowlist, and the wc_eco_upload_file AJAX action performs insufficient authorization, permitting file upload via the frontend nonce exposed on cart and checkout pages. There is no public exploit identified at time of analysis, but the CVSS 8.8 rating and the fact that only Subscriber access is required make this a serious risk; note the vendor only partially fixed it in 2.3.2.
Arbitrary post and page deletion in the Meta Box AIO plugin for WordPress (versions up to and including 3.8.0) allows unauthenticated attackers to destroy any content on the site. The MB Frontend Submission extension's template_redirect dispatcher routes the mbfs_delete action without any capability or ownership check, and its nonce protection is unreachable on non-AJAX requests, so any page hosting a frontend submission form becomes a deletion endpoint. No public exploit identified at time of analysis, but the trivial GET-based vector and 9.1 CVSS make this a high-priority integrity/availability threat.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Two-factor authentication bypass in the UsersWP WordPress plugin before 1.2.67 lets an attacker who already possesses a victim's username and password skip the second authentication factor and fully log in as that user. The two-factor login handler fails to validate the selected authentication provider (CWE-287), so the 2FA step can be circumvented. Publicly available exploit code exists and a vendor patch is released, but there is no public exploit identified as actively exploited in the wild.
Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Authentication bypass in the Advanced Responsive Video Embedder (ARVE) WordPress plugin version 10.8.7 lets unauthenticated attackers log in as any existing administrator by supplying a known hardcoded token. Because the token is a static SHA-256 hash embedded in the publicly readable plugin source, anyone can extract it and gain full administrative control of an affected site. Wordfence attributes this to a likely supply-chain compromise of the developer's account, and while no public exploit is identified at time of analysis, the EPSS score is modest (0.59%, 45th percentile) despite the maximal 9.8 CVSS.
Arbitrary file upload vulnerability in the Easy Digital Downloads WordPress plugin (≤3.6.9) allows authenticated attackers with Shop Manager-level access to upload malicious files via insufficient validation in the import file upload function, potentially achieving remote code execution. No public exploit or active exploitation reported at time of analysis. The fix was applied in the plugin trunk.
Privilege escalation in the Wholesale for WooCommerce WordPress plugin (all versions up to and including 2.0.5) lets any authenticated author-level user promote their own account to administrator, giving full control of the WordPress site. The save_requests_meta() handler runs the user_role_set POST parameter through only sanitize_text_field() and hands it straight to WP_User::add_role() with no allowlist of permitted wholesale roles and no current_user_can('promote_users') or manage_options check, while the request_user_role_nonce that gates the call is reachable by any author who has authored a wwp_requests post (obtainable through the plugin's own wholesale registration form). No public exploit identified at time of analysis - EPSS is 0.37% (29th percentile) and CISA SSVC records exploitation as 'none' - but the assessed technical impact is total once the low-privilege foothold requirement is satisfied, and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is faithfully reflected here.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Information disclosure in the Uncanny Automator WordPress plugin up to version 7.3.2 allows authenticated subscribers to enumerate Google Contact labels and Mautic segments, tags, and contact fields via missing capability checks and nonce verification in AJAX handlers. This enables low-privileged users to access data retrieved through administrator-configured integration credentials and potentially exhaust third‑party API quotas. No public exploit or active exploitation is known at this time.
SQL injection in the Web Directory Free WordPress plugin up to version 1.7.13 allows unauthenticated attackers to extract sensitive database information via the 'levels' parameter. The vulnerability has a high CVSS score of 7.5, but no active exploitation (CISA KEV) or public proof-of-concept has been identified at this time.
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. No public exploit code or active exploitation is known at this time, but the high CVSS score and low attack complexity warrant prompt attention.
Unauthenticated SQL injection in the Bookly WordPress plugin permits remote extraction of database content. Attackers leverage a two-step chain—first carrying a malicious staff_ids parameter via a session-seeding AJAX call, then triggering the vulnerable query through a second endpoint—to append time-based blind SQL payloads. No public exploit code is known, but the full attack path is documented by Wordfence.
Unauthenticated SQL injection in the TrueBooker WordPress plugin allows remote attackers to extract sensitive database information. The vulnerability resides in the 'alldata[truebooker_user]' parameter and affects versions up to and including 1.2.2. Although a nonce is used, it is exposed on front-end booking pages, enabling unauthenticated exploitation if the required booking fields are present.
Unauthenticated SQL injection in the WordPress Premium Packages - Sell Digital Products Securely plugin (wpdm-premium-packages) allows any remote attacker to extract sensitive data from the website’s database. The vulnerability exists in the coupon processing REST API endpoint and stems from user input being directly interpolated into a raw SQL query without any sanitization or prepared statements.
Remote unauthenticated SQL injection in the WordPress WP Fast Total Search plugin up to version 1.80.280 allows attackers to extract sensitive database information via the 'form_data[s]' parameter. The flaw requires no authentication or user interaction, making it easily exploitable over the network. No public exploit code or active exploitation has been confirmed at this time.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Arbitrary directory deletion in the Demi Backup & Migration WordPress plugin allows unauthenticated attackers to recursively delete any server directory. Affected versions 0.0.7 and earlier store a critical HMAC signing key inside a web‑accessible dotfile in the uploads folder without access control. An attacker who retrieves this key can forge signed AJAX requests to invoke a recursive cleanup routine with an attacker‑supplied absolute path, leading to complete deletion of targeted directories.
Integrity impact in the Xendit Payment WordPress plugin (<=7.1.0) allows unauthenticated remote attackers to modify payment settings without authentication. The vulnerability arises from missing authorization checks, enabling unauthorized changes to the plugin's configuration. No active exploitation or public exploit is currently known.
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.
Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.
Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Unauthenticated authentication bypass in Hide My WP Ghost WordPress plugin up to 7.0.06 allows remote attackers to gain subscriber-level access via an authorization flaw. The vulnerability exploits a user‑controlled key (CWE-639) to impersonate a subscriber without valid credentials, potentially leading to high confidentiality and integrity impact on the affected site. Exploitation requires high complexity but no user interaction or prior privileges, and while no active exploitation or public exploit code is currently confirmed, the issue is disclosed in a Patchstack advisory.
Unauthenticated modification of subscriber data in the Paid Member Subscriptions plugin for WordPress up to version 3.0.7 allows attackers to alter other users' membership or profile information by exploiting insecure direct object references. No authentication is required, and the attack can be performed remotely without user interaction, resulting in a high integrity impact. At the time of analysis, no public exploit or active exploitation has been identified.
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.
An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.
Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.
Unauthenticated broken access control in Thrive Product Manager plugin for WordPress versions up to and including 10.9.2 permits remote attackers to access or modify product-related functionality without authentication. The missing authorization checks can lead to low-impact confidentiality, integrity, and availability compromises, such as viewing or tampering with product data. No active exploitation has been confirmed, and no public exploit code is known at this time.
An unauthenticated broken access control flaw in the Post My CF7 Form WordPress plugin up to version 6.2.0 allows remote attackers to modify data handled by the plugin. No active exploitation has been confirmed and no public exploit code is known at the time of analysis; however, the vulnerability is trivial to exploit due to its network accessibility and lack of required privileges.
SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unspecified vulnerability in the Falcon - WordPress Optimizations & Tweaks plugin up to version 2.10.0 allows remote, unauthenticated attackers to cause a denial of service due to improper input validation (CWE-1284). The high-severity flaw (CVSS 7.5) impacts availability with no user interaction required. No public exploit or active exploitation has been confirmed, and EPSS data is unavailable.
Unauthenticated broken access control in Stripe For WooCommerce plugin version 4.0.7 and below allows remote attackers to modify plugin data without any authentication. The vulnerability
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Subscriber-level users can access sensitive shipping data in ShipTime: Discounted Shipping Rates plugin for WordPress versions up to 1.1.1, exposing high-value business information. The vulnerability allows authenticated users with minimal privileges to retrieve confidential data without further administrative access. No public exploit or official patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific namespace without requiring authentication, enabling any remote attacker to read sensitive customer booking information and modify other users' bookings. Public exploit code is available, making exploitation straightforward.
Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.
Download Manager WordPress plugin before 3.3.62 fails to bind temporary download tokens to user sessions, creating long-lived, reusable bearer tokens. An attacker who obtains a leaked token can repeatedly bypass authentication and download role- or password-protected files without authorization. Public proof-of-concept exploit code exists, though no active exploitation has been reported in the wild.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Unauthenticated arbitrary file upload leading to remote code execution exists in Realtyna Organic IDX plugin + WPL Real Estate for WordPress versions before 5.3.0. The file upload API, enabled by default, authenticates using hardcoded credentials identical across all installations and lacks file type validation, allowing attackers to upload and execute PHP files. Publicly available exploit code increases the likelihood of exploitation.