WordPress
Monthly
Remote code execution in Blocksy Companion Pro (the premium add-on plugin for the Blocksy WordPress theme) versions 2.1.45 and earlier allows authenticated users holding only the low-privilege Contributor role to inject and execute arbitrary PHP code on the host. The flaw, reported by Patchstack and tracked under CWE-94, carries a CVSS 3.1 base score of 8.5 with a changed scope, meaning successful exploitation can impact components beyond the WordPress application itself. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; no EPSS score was provided in the source data.
Reflected cross-site scripting in the SureCart WordPress e-commerce plugin (versions 4.3.2 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link. Because the CVSS scope is changed (S:C), the injected payload can act in the security context of the WordPress session, enabling theft of admin session data or actions performed on the victim's behalf. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Patchstack has cataloged it as a confirmed reflected XSS.
Reflected cross-site scripting in the Everest Forms WordPress plugin (versions 3.4.8 and earlier) lets an unauthenticated attacker craft a malicious link that, when opened by a victim, executes arbitrary JavaScript in the victim's browser under the affected site's origin. The CVSS:3.1 base score is 7.1 (scope-changed, low impact across C/I/A) and exploitation requires victim user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the WoodMart premium WooCommerce/WordPress theme (versions up to and including 8.5.3) allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim is lured into triggering a crafted request. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 7.1 with a changed scope, reflecting impact that crosses from the theme into the user's authenticated session context. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the WordPress "Advance Product Search" plugin (slug th-advance-product-search) through version 1.4.4 lets remote attackers inject crafted SQL via a search-facing parameter without any login. Because the CVSS vector marks privileges as none (PR:N) and a scope change (S:C), an attacker can reach and read backend database content reachable from the plugin's queries. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the high 9.3 score is driven by the unauthenticated network vector and confidentiality impact rather than any confirmed in-the-wild activity.
Availability-impacting Insecure Direct Object Reference in the WordPress Toolset Forms (CRED Frontend Editor) plugin version 2.6.24 and earlier lets unauthenticated remote attackers manipulate object identifiers to act on records they should not control. The flaw was reported by Patchstack and carries CVSS 7.5; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. Because the CVSS vector scores only Availability (A:H), the practical impact is disruption or destruction of plugin-managed objects rather than data disclosure.
SQL injection in the Crocoblock JetEngine WordPress plugin (versions 3.8.10.2 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries (CWE-89), per the CVSS:3.1 vector with PR:N/UI:N. The flaw carries a 9.3 critical score driven by network reachability, no required privileges, and a changed scope exposing the underlying WordPress database. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a high-priority patching target for any site running this widely deployed dynamic-content plugin.
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (Crocoblock) affects all versions up to and including 3.8.3, letting remote attackers with no authentication inject crafted SQL through plugin filter parameters and read sensitive database contents. The CVSS 9.3 rating reflects network reachability with no privileges or user interaction required; the issue was reported by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Tourfic WordPress plugin (versions 2.22.5 and earlier) lets authenticated subscriber-level users inject arbitrary SQL through a vulnerable parameter, exposing the WordPress database. Because only a low-privilege account is required and registration is often open on WordPress sites, an attacker can read sensitive data such as user records and credential hashes. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Broken access control in the WordPress "MailChimp Block" plugin (versions 1.1.15 and earlier) lets unauthenticated remote attackers invoke protected plugin functionality without any authorization check, per the CVSS:3.1 vector (AV:N/PR:N/UI:N) and Patchstack's CWE-862 classification. The scope-changed vector (S:C) with low confidentiality, integrity, and availability impact indicates the missing authorization can affect resources beyond the vulnerable component itself. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated SQL injection in the Quotes llama WordPress plugin (versions 3.1.5 and earlier) lets remote attackers without credentials inject malicious SQL through plugin input handling, exposing the WordPress database. The CVSS 3.1 base score of 9.3 reflects network reachability with no authentication and a scope change, meaning impact can reach beyond the plugin into the underlying database. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Improper authorization in the Subscriptions for WooCommerce WordPress plugin (versions 1.9.5 and earlier) lets unauthenticated remote attackers reach functionality that should be access-restricted, enabling unauthorized modification of subscription data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, no-authentication, low-complexity abuse with a high integrity impact but no confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Print Invoice & Delivery Notes for WooCommerce plugin (versions 7.1.1 and earlier) lets remote attackers retrieve sensitive order data - such as invoices and delivery notes - without any credentials. The CVSS 3.1 score of 7.5 reflects a network-reachable, no-interaction confidentiality breach. No public exploit is identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven but trivially feasible given the access profile.
Arbitrary file upload in the Travel Booking WordPress theme (versions <= 2.2.5) lets an authenticated low-privileged Subscriber upload files of dangerous types, enabling web shell deployment and remote code execution. The CVSS 3.1 base score is 9.9 with a scope change (S:C), reflecting that a minimally-privileged account can fully compromise the underlying host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file upload in the Quform WordPress plugin (versions <= 2.23.0) lets authenticated users with only Subscriber-level privileges upload files of attacker-controlled type, enabling web shell deployment and full site takeover. The CVSS:3.1 vector (PR:L, S:C) reflects a low privilege bar combined with a scope change, which drives the 9.9 score. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
PHP Object Injection in the Uncanny Automator Pro WordPress plugin (versions <= 7.3.0.6) allows authenticated users holding only the low-privileged Subscriber role to inject crafted serialized PHP objects into an unsafe deserialization sink (CWE-502). Depending on the gadget chains present in the plugin or co-installed software, this can escalate to remote code execution, arbitrary file operations, or database tampering. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the input-supplied CVSS of 9.8 likely overstates privileges since the title explicitly scopes the flaw to the Subscriber role.
Authenticated PHP object injection in the RealHomes WordPress theme (versions 4.5.3 and earlier) lets a low-privileged Subscriber-level account inject crafted serialized objects into an unsafe deserialization sink (CWE-502). Because WordPress applications and plugins commonly contain POP gadget chains, this can escalate to arbitrary file operations, SQL injection, or remote code execution, which is reflected in the high CVSS 8.8 (C:H/I:H/A:H). Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Perfmatters WordPress plugin (versions 2.6.3 and earlier) allows unauthenticated attackers to inject malicious script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that successful exploitation can affect resources beyond the vulnerable component, such as an authenticated administrator's session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored/reflected cross-site scripting in the WP Automatic WordPress plugin (versions before 3.135.1) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they visit or interact with a crafted resource. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script can affect components beyond the vulnerable plugin context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Blog2Social WordPress plugin (versions 8.9.2 and earlier) lets unauthenticated remote attackers inject malicious JavaScript that executes in a victim's browser when they view an affected page. The CVSS 3.1 vector (AV:N/PR:N/UI:R) indicates no authentication is required but the victim must take an action such as visiting a crafted URL. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with this report from Patchstack.
Stored/reflected Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.110.1) lets unauthenticated attackers inject malicious script that executes in a victim's browser when they view the affected page. The CVSS:3.1 vector (AV:N/PR:N/UI:R, scope changed) indicates network-reachable, no-authentication exploitation that requires the victim to interact with attacker-controlled content. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cross-site scripting in the Responsive Lightbox WordPress plugin (versions up to and including 2.7.6) lets unauthenticated remote attackers inject script that executes in a victim's browser when they interact with a crafted link or page. The CVSS 3.1 score of 7.1 reflects a scope-changing reflected/stored XSS (UI:R) that can run in the context of any visitor or logged-in administrator. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site scripting in the Gutenverse Form WordPress plugin (versions ≤ 2.4.7) lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim interacts with a crafted link or page. The CVSS:3.1 score is 7.1 with a changed scope, reflecting that injected script crosses the trust boundary into the user's authenticated WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Reflected cross-site scripting in the Quick Interest Slider WordPress plugin (versions 3.1.6 and earlier) lets an unauthenticated attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious page. The CVSS 3.1 base score is 7.1 with a scope change, reflecting that script execution crosses the plugin's security boundary into the broader WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the Frisbii Pay (reepay-checkout-gateway) WordPress plugin through version 1.8.2 allows a low-privileged authenticated user holding a Contributor role to elevate to higher privileges due to a missing authorization check. Reported through Patchstack's audit program and tagged as both Authentication Bypass and Privilege Escalation, the flaw carries a CVSS 8.8 and full confidentiality, integrity, and availability impact, meaning a successful actor can effectively take administrative control of the affected WordPress site. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated SQL injection in the WordPress payment plugin 워드프레스 결제 심플페이 (SimplePay / pgall-for-woocommerce) version 5.5.6 and earlier lets remote attackers inject arbitrary SQL against the WooCommerce database without any authentication or user interaction. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), exploitation is trivial and network-reachable, with high confidentiality impact and a changed scope. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and related weaknesses in the BitFire Security WordPress firewall plugin (versions 5.0.3 and earlier) let remote unauthenticated attackers extract sensitive data and tamper with limited integrity, per a Patchstack-reported advisory. The CVSS 3.1 base score of 8.6 reflects network-reachable, no-privilege exploitation (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact, ironic for a product whose purpose is to harden WordPress sites. No public exploit code has been identified at time of analysis, and the issue is not on the CISA KEV list; EPSS data was not provided.
SQL injection in the Library Management System WordPress plugin (versions 3.5.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through an unsanitized input parameter (CWE-89). The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, no-authentication, low-complexity exploitation with high confidentiality impact, enabling extraction of database contents such as WordPress user records and credential hashes. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Dokan Pro (the WordPress/WooCommerce multivendor marketplace plugin) versions 5.0.4 and earlier lets unauthenticated remote attackers gain elevated privileges, scoring CVSS:3.1 9.8 Critical via AV:N/AC:L/PR:N/UI:N with full confidentiality, integrity, and availability impact. The flaw is classed as CWE-266 (Incorrect Privilege Assignment), meaning the plugin grants privileges it should not to an unauthenticated requester. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the BuddyBoss Platform WordPress plugin (versions 3.0.4 and earlier) allows attackers with low-privilege Subscriber access to inject crafted serialized objects that are deserialized unsafely, potentially leading to remote code execution, data tampering, or denial of service depending on available gadget chains. The flaw was reported by Patchstack and carries a CVSS base score of 9.8; however, the 'Subscriber' qualifier implies authenticated access is required, which conflicts with the PR:N in the published vector. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the Uncanny Automator WordPress plugin (versions 7.3.1.2 and earlier) lets unauthenticated remote attackers submit crafted serialized PHP objects that the application deserializes, potentially leading to full WordPress site compromise. The flaw is rooted in unsafe deserialization of untrusted data (CWE-502) and carries high confidentiality, integrity, and availability impact (CVSS 8.1). No public exploit identified at time of analysis and it is not in CISA KEV; the high attack complexity reflects the need for a usable POP gadget chain in the target environment.
Unauthenticated privilege escalation in the Paytium WordPress plugin (Mollie payment forms and donations) through version 5.0.2 allows remote attackers with no authentication to gain elevated privileges, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. The flaw stems from incorrect privilege assignment (CWE-266), meaning a low- or no-privilege actor can be granted rights they should not have. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (versions 2.7.4 and earlier) lets unauthenticated remote attackers manipulate the payment/integration workflow without valid credentials, per the CVSS 3.1 vector (AV:N/PR:N) and CWE-288. The flaw scores 7.5 with integrity impact only (I:H, C:N, A:N), meaning an attacker can tamper with trusted state - most plausibly forging payment confirmation/callback validation - rather than steal data or take a site down. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Easy Elements for Elementor - Addons & Website Templates WordPress plugin (versions <= 1.4.9) allows remote attackers to gain elevated privileges without authentication, per the CVSS:3.1 vector (PR:N). Classified as CWE-266 (Incorrect Privilege Assignment) and rated CVSS 9.8 with full confidentiality, integrity, and availability impact, the flaw was reported by the Patchstack security team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in Booster for WooCommerce (plugin slug woocommerce-jetpack) versions <= 8.0.1 lets an authenticated customer-level user upload arbitrary files to the WordPress server, enabling web shell deployment and remote code execution. The CVSS 3.1 score of 9.9 reflects a scope change (S:C) where a low-privilege shop customer can fully compromise the underlying host. No public exploit identified at time of analysis; the issue was reported by Patchstack's audit team.
Broken access control in the Paymob for WooCommerce WordPress plugin (versions <= 4.1.2) allows remote unauthenticated attackers to invoke a protected function or action that lacks an authorization check, producing a high integrity impact (CVSS 7.5, CVSS:3.1/.../I:H). The flaw maps to CWE-862 (Missing Authorization), meaning a function reachable over the network performs no capability or ownership validation before acting. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Reflected/stored Cross-Site Scripting in the MapPress Maps for WordPress plugin (versions 2.97.3 and earlier) allows an unauthenticated remote attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted link or page. Because the CVSS scope is changed (S:C), the injected script can act beyond the vulnerable component to affect logged-in users including administrators. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Abandoned Cart Pro for WooCommerce plugin (versions <= 10.4.0) allows an authenticated low-privileged user (Subscriber) to elevate their own permissions and gain higher-privileged capabilities within the WordPress site. The flaw, reported by Patchstack and classified as CWE-266 (Incorrect Privilege Assignment), carries a CVSS 8.8 and is network-exploitable with low complexity once an attacker holds any minimal account. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Fusion Builder WordPress plugin (versions 3.15.4 and earlier) lets a low-privileged authenticated user, such as a Contributor, gain capabilities far beyond their role and effectively act as an administrator. The flaw was reported by Patchstack and carries a CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Fusion Builder is the page builder bundled with the widely sold Avada theme, the exposure spans a large number of WordPress sites that allow self-registration or untrusted contributor accounts.
Unauthorized data exposure in the Stylish Cost Calculator WordPress plugin (versions 8.3.9 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, exposing sensitive information. Reported through Patchstack and classified as a broken access control / missing authorization flaw (CWE-862), it carries a CVSS 7.5 with confidentiality-only impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in the Syncee Premium Dropshipping & Wholesale WordPress plugin (versions <= 1.0.27) lets remote unauthenticated attackers reach functionality that should be access-restricted, exposing confidential information without any login. Reported by Patchstack and tagged as an authentication bypass, the flaw stems from missing authorization checks (CWE-862) on plugin endpoints. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied data, but the CVSS 3.1 base score of 7.5 reflects easy network reach with a high confidentiality impact.
Missing authorization in the Newsletters (newsletters-lite) WordPress plugin through version 4.13 lets unauthenticated remote attackers reach functionality that should be access-controlled, producing limited confidentiality, integrity, and availability impact (CVSS 7.3). Reported by Patchstack and tagged as an authentication bypass, the flaw requires no credentials or user interaction, though no public exploit code or CISA KEV listing exists at time of analysis. The partial (Low) impact across all three dimensions suggests scoped data exposure or unauthorized actions rather than full site compromise.
Sensitive data exposure in the Trinity Backup WordPress plugin (versions 2.0.9 and earlier) allows remote unauthenticated attackers to retrieve confidential information without any credentials. Because the plugin manages full-site backups, the exposed data may include database dumps, configuration files, and credentials. The flaw was reported by Patchstack and carries a CVSS 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the All-In-One Intranet WordPress plugin (versions ≤ 1.8.1) allows unauthenticated remote attackers to bypass the plugin's core 'force login / private site' restriction and read content that is supposed to be visible only to authenticated intranet members. The flaw is a missing authorization check (CWE-862) that undermines the single security feature the plugin exists to provide. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Improper authorization in the Five Star Restaurant Menu WordPress plugin (versions <= 2.5.2) lets unauthenticated remote attackers invoke restricted functionality and modify data without any credentials. The CVSS 3.1 vector (AV:N/PR:N/UI:N) and CWE-862 indicate the plugin exposes one or more actions that lack capability/nonce checks, scored 7.5 with integrity-only impact (C:N/I:H/A:N). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack's audit team and tagged as an Authentication Bypass.
Sensitive data exposure in the WordPress plugin Object Cache 4 everyone (versions 2.3.2 and earlier) lets remote unauthenticated attackers retrieve information the application intended to keep private, per the Patchstack advisory and a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). The flaw, classed as CWE-201, stems from the caching layer inadvertently exposing sensitive cached content to unauthorized requestors. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated backdoor in the WordPress "Enable CORS" plugin (versions <= 2.0.3) lets remote attackers leverage a hard-coded cryptographic key (CWE-321) to bypass access controls and read or alter protected data without any credentials. Reported by Patchstack and tagged as Information Disclosure, the issue carries a CVSS 7.4; no public exploit and no CISA KEV listing exist at the time of analysis, and despite the network attack vector the CVSS marks high attack complexity, indicating exploitation is non-trivial.
Unauthorized data modification in the Gutenverse Companion WordPress plugin (versions 2.5.0 and earlier) lets remote unauthenticated attackers invoke protected functionality due to a missing authorization check. The CVSS 3.1 vector (AV:N/PR:N/UI:N, I:H, C:N, A:N) indicates a network-reachable, no-login integrity compromise rather than data theft or outage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.162) allows remote unauthenticated attackers to inject malicious SQL into backend queries, per Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with PR:N indicates exploitation requires no authentication, and the scope-changed, high-confidentiality rating (S:C/C:H) points to database disclosure beyond the plugin's own data. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the Real Estate 7 WordPress theme (versions up to and including 3.5.9) lets unauthenticated remote attackers inject malicious SQL through an unsanitized parameter, exposing backend database contents. The CVSS 3.1 base score is 9.3 (S:C/C:H) driven by the scope change and high confidentiality impact, with no authentication or user interaction required. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported through Patchstack's vulnerability research program.
Insecure Direct Object Reference in the SupportCandy WordPress helpdesk plugin (versions 3.4.6 and earlier) lets an authenticated low-privilege user (Subscriber) access support tickets and data belonging to other users by manipulating object identifiers, effectively bypassing authorization controls. The flaw carries a CVSS 3.1 base score of 7.6 (PR:L) and was reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis. Because SupportCandy frequently runs on sites with open user registration, the Subscriber prerequisite is often trivially met.
Unauthenticated SQL injection in the wpDataTables WordPress plugin (versions up to and including 7.4) lets remote attackers inject crafted SQL into database queries without any authentication or user interaction, exposing the WordPress backend database. With a CVSS 9.3 (critical) score and a CWE-89 root cause, the flaw enables extraction of sensitive data such as user credentials and configuration secrets. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated information disclosure in the Ads by WPQuads (Quick AdSense Reloaded) WordPress plugin versions 3.0.3 and earlier lets remote attackers read sensitive data without any credentials or user interaction. The flaw, reported by Patchstack and classified as CWE-497, exposes information to an unauthorized control sphere over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetBooking WordPress plugin (versions 4.0.4.1 and earlier) lets remote attackers inject crafted SQL into a vulnerable query without any login, exposing the WordPress database. Reported by Patchstack with a CVSS 9.3 (scope-changed, high confidentiality impact), the flaw allows extraction of sensitive data such as user credentials and booking records. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection in the SALESmanago & Leadoo WordPress plugin before 3.11.3 allows low-privileged authenticated users to inject arbitrary SQL through an unsanitised parameter passed to a vulnerable AJAX action. Because the action enforces no authorisation check, even subscriber-level accounts can reach it, and the CVSS scope-changed, high-confidentiality rating (7.7) reflects the ability to read data across the WordPress database. Publicly available exploit code exists (WPScan), though EPSS is low (0.16%) and SSVC classifies exploitation as proof-of-concept only, not active.
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the titles and content of private, draft, and other non-public posts by abusing a REST API endpoint that lacks proper authorization and fails to validate a user-supplied query parameter. WPScan reported the flaw, a public exploit exists, and a vendor patch is available; the CVSS 3.1 score is 7.5 reflecting high confidentiality impact with no integrity or availability effect.
Arbitrary file upload in Daan.Dev's OMGF Pro WordPress plugin (versions through 5.2.6) lets remote attackers upload files of dangerous types, enabling webshell deployment and full site/server takeover. The CVSS 3.1 base score is 10.0 with a scope-changed vector, and the vector's PR:N indicates the flaw is reachable without authentication. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive data exposure in the APIExperts Square for WooCommerce WordPress plugin (also known as woosquare) through version 4.7.3 allows remote attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. Reported by Patchstack and rated CVSS 8.3, the flaw stems from CWE-201 (Insertion of Sensitive Information Into Sent Data) and is exploitable without authentication or user interaction per its CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
SQL injection in the YMC Filter (YMC Smart Filter / Filter Grids) WordPress plugin lets remote attackers inject malicious SQL through unsanitized input, affecting all versions up to and including 3.11.5. Per the CVSS vector (PR:N), exploitation is unauthenticated and network-reachable, enabling database content disclosure and a scope change beyond the plugin's own data. No public exploit identified at time of analysis, and no EPSS score was supplied, so real-world exploitation prevalence is currently unmeasured.
Broken access control in the Royal MCP WordPress plugin (versions up to and including 1.4.25) lets authenticated low-privilege users reach functionality that should be restricted, due to a missing authorization check. With a CVSS of 8.1 and high confidentiality and integrity impact, an attacker holding even a basic account can read and alter data they should not be able to touch. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the Forminator WordPress plugin (versions 1.53.1 and earlier, by WPMU DEV) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, score 7.1) confirms no authentication is required but that user interaction triggers the payload, and the changed scope means the injected script runs in a security context beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed through Patchstack.
PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows an authenticated attacker holding only a low-privilege Subscriber account to inject crafted serialized objects into an unsafe deserialization sink. Depending on the PHP gadget chains present in WordPress core, the plugin, or other installed plugins, this can escalate to data tampering, information disclosure, or remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Patchstack.
Reflected cross-site scripting in the TablePress WordPress plugin (versions 3.3.1 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, including the WordPress admin session context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported through Patchstack's WordPress vulnerability program.
Remote code execution in the Post Snippets WordPress plugin (versions 4.0.19 and earlier) lets an authenticated user with only Contributor-level privileges inject and execute arbitrary PHP/code on the server via the plugin's snippet-handling functionality (CWE-94). Because a low-privilege role can pivot to full server compromise with a scope change (S:C), this is a privilege-escalation-to-RCE flaw reported by Patchstack; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Advanced Order Export For WooCommerce WordPress plugin (by AlgolPlus) affects all versions up to and including 4.0.9, letting a remote attacker inject script that executes in the browser of a victim who views attacker-controlled order/export data. The flaw carries a CVSS 7.1 rating driven by a scope change (attacker script runs outside the vulnerable component's security context) and requires victim interaction; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
Stored or reflected cross-site scripting in the Averta Master Slider WordPress plugin (versions 3.11.2 and earlier) lets unauthenticated remote attackers inject script that executes in a victim's browser, but only after the victim interacts with attacker-supplied content (UI:R). The CVSS:3.1 vector's scope change (S:C) reflects that injected code runs in the browser's trust context rather than the plugin's, enabling session theft or actions on behalf of the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Reflected cross-site scripting in the H5P WordPress plugin (versions 1.17.6 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link, per the CVSS PR:N/UI:R vector. Because the scope is changed (S:C), successful execution can reach beyond the vulnerable component into the authenticated WordPress session context, enabling session/cookie theft or admin-context actions. There is no public exploit identified and the issue is not listed in CISA KEV, so risk is moderate (CVSS 7.1) and contingent on social-engineering a logged-in user.
Stored/reflected Cross-Site Scripting in Melapress's WP Activity Log WordPress plugin (versions <= 5.6.3.1, reported by Patchstack) lets a low-privileged Subscriber-level user inject script that executes in another user's browser, with a CVSS-rated scope change (S:C) meaning the payload can affect resources beyond the plugin's own security context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; direct impact is limited (C:L/I:L/A:L) but the cross-context scope and low attack complexity make it relevant for sites that allow open registration.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.8, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Per its CVSS:3.1 vector (AV:N/PR:N), exploitation is network-reachable and unauthenticated, though the high attack complexity (AC:H) implies non-trivial preconditions. This is classified as information disclosure but rated 8.1 with full C/I/A impact; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
Missing authorization in the CheckView Automated Testing WordPress plugin (versions 2.1.0 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, enabling unauthorized modification of site data or test/automation state. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, no-interaction flaw with high integrity impact but no confidentiality or availability loss. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in the WC Vendors Marketplace WordPress plugin (versions <= 2.6.8) allows authenticated users holding only a low-privilege Subscriber-level account to inject arbitrary SQL into backend queries. Reported by Patchstack and tracked as CVE-2026-54838 (CWE-89), the flaw carries a CVSS 8.5 with a scope change, reflecting that a minimally-privileged marketplace account can read sensitive data across the WordPress database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in the Five Star Restaurant Reservations WordPress plugin (version 2.7.19 and earlier) lets remote unauthenticated attackers invoke protected plugin functionality and modify data without holding any account, per the CVSS PR:N vector. The flaw is a broken access control / missing capability check (CWE-862) reported by Patchstack, with a CVSS 3.1 base score of 7.5 driven entirely by integrity impact (C:N/I:H/A:N). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.4.109) lets remote unauthenticated attackers invoke privileged actions they should not reach, due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required, with a high integrity impact but no confidentiality or availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Code injection in the Widget Options WordPress plugin (versions <= 4.2.3, by marketingfire) allows authenticated users holding the low-privileged Contributor role to achieve remote code execution on the host. Because exploitation only requires a Contributor account - a role frequently granted on multi-author and membership sites - an attacker who can register or compromise such an account can run arbitrary PHP and fully take over the site. There is no public exploit identified at time of analysis, but the 9.9 CVSS and CWE-94 classification place this at the most severe end of WordPress plugin flaws.
SQL injection in the WordPress SALESmanago & Leadoo plugin (versions 3.11.2 and earlier) lets authenticated users holding only Subscriber-level privileges inject arbitrary SQL into backend database queries, enabling extraction of sensitive data from the WordPress database. Reported by Patchstack and rated CVSS 8.5, it is dangerous because Subscriber is the lowest authenticated role and is frequently self-registerable on WordPress sites. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Sensitive data exposure in the Visual Link Preview WordPress plugin (versions 2.3.1 and earlier) allows a low-privileged Subscriber-level authenticated user to access information they should not be authorized to view. The CVSS 3.1 vector (PR:L) indicates only minimal authenticated access is needed, and the changed scope reflects data leaking beyond the plugin's intended security boundary. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Broken access control in the MainWP Child WordPress plugin (versions 6.1.1 and earlier) allows remote attackers to invoke privileged actions without proper authorization checks (CWE-862). Because the flaw is reachable without authentication (PR:N) it can be triggered by external attackers, though exploitation depends on tricking a user into an action (UI:R) and on overcoming non-trivial conditions (AC:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the Tourfic WordPress travel-booking plugin (versions through 2.22.7) lets remote attackers read arbitrary database contents via the 'post_id' parameter of the tf_room_availability AJAX action. Because the action is registered for logged-out users (wp_ajax_nopriv) and the required nonce is publicly emitted on single-hotel pages, no authentication is needed in practice. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Stored cross-site scripting in the Email Address Encoder WordPress plugin (free, before 1.0.25) and its Email Encoder Premium counterpart (before 0.3.12) lets unauthenticated visitors inject persistent JavaScript through the plugin's flawed email-replacement handling. Publicly available exploit code exists (disclosed by WPScan) and a vendor patch is available, but it is not in CISA KEV, so there is no public exploit identified as actively used in the wild. Successful exploitation executes attacker script in the browser of any user who later renders the affected page, typically an authenticated administrator.
SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remote attackers inject SQL through the 'latitude' and 'longitude' request parameters, enabling extraction of arbitrary database contents such as user credentials, API keys, and order data. The flaw is time-based (blind) and requires no authentication or user interaction, but no public exploit code or active exploitation has been identified at time of analysis. No EPSS or CISA KEV signal was provided in the source data.
Authenticated PHP code injection in the AdRotate Banner Manager WordPress plugin (versions ≤5.17.7) allows Contributor-level users to execute arbitrary PHP on the server by abusing the 'banner' attribute of the [adrotate] shortcode. Exploitation requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings, where unsanitized input is concatenated into a PHP string wrapped in mfunc/fragment cache markers. Reported by Wordfence; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in FunnelKit Funnel Builder for WordPress (versions up to and including 3.15.0.5) allows authenticated attackers with high privileges to inject arbitrary SQL queries against the underlying database. The flaw is reported by Patchstack and tracked as CWE-89; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. The CVSS scope change combined with confidentiality impact indicates database contents beyond the plugin context can be exfiltrated one bit at a time via blind techniques.
Account takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated users to harvest live password reset links for any account, including administrators, by chaining three logic bugs in the member directory subsystem. The flaw enables full site compromise because reset URLs can be used to set new administrator passwords. No public exploit identified at time of analysis, though Wordfence has published detailed technical write-ups that significantly lower the bar for weaponization.
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.
Remote code execution in Blocksy Companion Pro (the premium add-on plugin for the Blocksy WordPress theme) versions 2.1.45 and earlier allows authenticated users holding only the low-privilege Contributor role to inject and execute arbitrary PHP code on the host. The flaw, reported by Patchstack and tracked under CWE-94, carries a CVSS 3.1 base score of 8.5 with a changed scope, meaning successful exploitation can impact components beyond the WordPress application itself. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; no EPSS score was provided in the source data.
Reflected cross-site scripting in the SureCart WordPress e-commerce plugin (versions 4.3.2 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link. Because the CVSS scope is changed (S:C), the injected payload can act in the security context of the WordPress session, enabling theft of admin session data or actions performed on the victim's behalf. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Patchstack has cataloged it as a confirmed reflected XSS.
Reflected cross-site scripting in the Everest Forms WordPress plugin (versions 3.4.8 and earlier) lets an unauthenticated attacker craft a malicious link that, when opened by a victim, executes arbitrary JavaScript in the victim's browser under the affected site's origin. The CVSS:3.1 base score is 7.1 (scope-changed, low impact across C/I/A) and exploitation requires victim user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the WoodMart premium WooCommerce/WordPress theme (versions up to and including 8.5.3) allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim is lured into triggering a crafted request. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 7.1 with a changed scope, reflecting impact that crosses from the theme into the user's authenticated session context. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the WordPress "Advance Product Search" plugin (slug th-advance-product-search) through version 1.4.4 lets remote attackers inject crafted SQL via a search-facing parameter without any login. Because the CVSS vector marks privileges as none (PR:N) and a scope change (S:C), an attacker can reach and read backend database content reachable from the plugin's queries. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the high 9.3 score is driven by the unauthenticated network vector and confidentiality impact rather than any confirmed in-the-wild activity.
Availability-impacting Insecure Direct Object Reference in the WordPress Toolset Forms (CRED Frontend Editor) plugin version 2.6.24 and earlier lets unauthenticated remote attackers manipulate object identifiers to act on records they should not control. The flaw was reported by Patchstack and carries CVSS 7.5; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. Because the CVSS vector scores only Availability (A:H), the practical impact is disruption or destruction of plugin-managed objects rather than data disclosure.
SQL injection in the Crocoblock JetEngine WordPress plugin (versions 3.8.10.2 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries (CWE-89), per the CVSS:3.1 vector with PR:N/UI:N. The flaw carries a 9.3 critical score driven by network reachability, no required privileges, and a changed scope exposing the underlying WordPress database. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a high-priority patching target for any site running this widely deployed dynamic-content plugin.
Unauthenticated SQL injection in the JetSmartFilters WordPress plugin (Crocoblock) affects all versions up to and including 3.8.3, letting remote attackers with no authentication inject crafted SQL through plugin filter parameters and read sensitive database contents. The CVSS 9.3 rating reflects network reachability with no privileges or user interaction required; the issue was reported by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Tourfic WordPress plugin (versions 2.22.5 and earlier) lets authenticated subscriber-level users inject arbitrary SQL through a vulnerable parameter, exposing the WordPress database. Because only a low-privilege account is required and registration is often open on WordPress sites, an attacker can read sensitive data such as user records and credential hashes. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Broken access control in the WordPress "MailChimp Block" plugin (versions 1.1.15 and earlier) lets unauthenticated remote attackers invoke protected plugin functionality without any authorization check, per the CVSS:3.1 vector (AV:N/PR:N/UI:N) and Patchstack's CWE-862 classification. The scope-changed vector (S:C) with low confidentiality, integrity, and availability impact indicates the missing authorization can affect resources beyond the vulnerable component itself. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated SQL injection in the Quotes llama WordPress plugin (versions 3.1.5 and earlier) lets remote attackers without credentials inject malicious SQL through plugin input handling, exposing the WordPress database. The CVSS 3.1 base score of 9.3 reflects network reachability with no authentication and a scope change, meaning impact can reach beyond the plugin into the underlying database. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Improper authorization in the Subscriptions for WooCommerce WordPress plugin (versions 1.9.5 and earlier) lets unauthenticated remote attackers reach functionality that should be access-restricted, enabling unauthorized modification of subscription data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, no-authentication, low-complexity abuse with a high integrity impact but no confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Print Invoice & Delivery Notes for WooCommerce plugin (versions 7.1.1 and earlier) lets remote attackers retrieve sensitive order data - such as invoices and delivery notes - without any credentials. The CVSS 3.1 score of 7.5 reflects a network-reachable, no-interaction confidentiality breach. No public exploit is identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven but trivially feasible given the access profile.
Arbitrary file upload in the Travel Booking WordPress theme (versions <= 2.2.5) lets an authenticated low-privileged Subscriber upload files of dangerous types, enabling web shell deployment and remote code execution. The CVSS 3.1 base score is 9.9 with a scope change (S:C), reflecting that a minimally-privileged account can fully compromise the underlying host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file upload in the Quform WordPress plugin (versions <= 2.23.0) lets authenticated users with only Subscriber-level privileges upload files of attacker-controlled type, enabling web shell deployment and full site takeover. The CVSS:3.1 vector (PR:L, S:C) reflects a low privilege bar combined with a scope change, which drives the 9.9 score. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
PHP Object Injection in the Uncanny Automator Pro WordPress plugin (versions <= 7.3.0.6) allows authenticated users holding only the low-privileged Subscriber role to inject crafted serialized PHP objects into an unsafe deserialization sink (CWE-502). Depending on the gadget chains present in the plugin or co-installed software, this can escalate to remote code execution, arbitrary file operations, or database tampering. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the input-supplied CVSS of 9.8 likely overstates privileges since the title explicitly scopes the flaw to the Subscriber role.
Authenticated PHP object injection in the RealHomes WordPress theme (versions 4.5.3 and earlier) lets a low-privileged Subscriber-level account inject crafted serialized objects into an unsafe deserialization sink (CWE-502). Because WordPress applications and plugins commonly contain POP gadget chains, this can escalate to arbitrary file operations, SQL injection, or remote code execution, which is reflected in the high CVSS 8.8 (C:H/I:H/A:H). Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Perfmatters WordPress plugin (versions 2.6.3 and earlier) allows unauthenticated attackers to inject malicious script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that successful exploitation can affect resources beyond the vulnerable component, such as an authenticated administrator's session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored/reflected cross-site scripting in the WP Automatic WordPress plugin (versions before 3.135.1) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they visit or interact with a crafted resource. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script can affect components beyond the vulnerable plugin context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Blog2Social WordPress plugin (versions 8.9.2 and earlier) lets unauthenticated remote attackers inject malicious JavaScript that executes in a victim's browser when they view an affected page. The CVSS 3.1 vector (AV:N/PR:N/UI:R) indicates no authentication is required but the victim must take an action such as visiting a crafted URL. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with this report from Patchstack.
Stored/reflected Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.110.1) lets unauthenticated attackers inject malicious script that executes in a victim's browser when they view the affected page. The CVSS:3.1 vector (AV:N/PR:N/UI:R, scope changed) indicates network-reachable, no-authentication exploitation that requires the victim to interact with attacker-controlled content. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cross-site scripting in the Responsive Lightbox WordPress plugin (versions up to and including 2.7.6) lets unauthenticated remote attackers inject script that executes in a victim's browser when they interact with a crafted link or page. The CVSS 3.1 score of 7.1 reflects a scope-changing reflected/stored XSS (UI:R) that can run in the context of any visitor or logged-in administrator. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site scripting in the Gutenverse Form WordPress plugin (versions ≤ 2.4.7) lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim interacts with a crafted link or page. The CVSS:3.1 score is 7.1 with a changed scope, reflecting that injected script crosses the trust boundary into the user's authenticated WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Reflected cross-site scripting in the Quick Interest Slider WordPress plugin (versions 3.1.6 and earlier) lets an unauthenticated attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious page. The CVSS 3.1 base score is 7.1 with a scope change, reflecting that script execution crosses the plugin's security boundary into the broader WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in the Frisbii Pay (reepay-checkout-gateway) WordPress plugin through version 1.8.2 allows a low-privileged authenticated user holding a Contributor role to elevate to higher privileges due to a missing authorization check. Reported through Patchstack's audit program and tagged as both Authentication Bypass and Privilege Escalation, the flaw carries a CVSS 8.8 and full confidentiality, integrity, and availability impact, meaning a successful actor can effectively take administrative control of the affected WordPress site. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated SQL injection in the WordPress payment plugin 워드프레스 결제 심플페이 (SimplePay / pgall-for-woocommerce) version 5.5.6 and earlier lets remote attackers inject arbitrary SQL against the WooCommerce database without any authentication or user interaction. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), exploitation is trivial and network-reachable, with high confidentiality impact and a changed scope. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure and related weaknesses in the BitFire Security WordPress firewall plugin (versions 5.0.3 and earlier) let remote unauthenticated attackers extract sensitive data and tamper with limited integrity, per a Patchstack-reported advisory. The CVSS 3.1 base score of 8.6 reflects network-reachable, no-privilege exploitation (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact, ironic for a product whose purpose is to harden WordPress sites. No public exploit code has been identified at time of analysis, and the issue is not on the CISA KEV list; EPSS data was not provided.
SQL injection in the Library Management System WordPress plugin (versions 3.5.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through an unsanitized input parameter (CWE-89). The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, no-authentication, low-complexity exploitation with high confidentiality impact, enabling extraction of database contents such as WordPress user records and credential hashes. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Dokan Pro (the WordPress/WooCommerce multivendor marketplace plugin) versions 5.0.4 and earlier lets unauthenticated remote attackers gain elevated privileges, scoring CVSS:3.1 9.8 Critical via AV:N/AC:L/PR:N/UI:N with full confidentiality, integrity, and availability impact. The flaw is classed as CWE-266 (Incorrect Privilege Assignment), meaning the plugin grants privileges it should not to an unauthenticated requester. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the BuddyBoss Platform WordPress plugin (versions 3.0.4 and earlier) allows attackers with low-privilege Subscriber access to inject crafted serialized objects that are deserialized unsafely, potentially leading to remote code execution, data tampering, or denial of service depending on available gadget chains. The flaw was reported by Patchstack and carries a CVSS base score of 9.8; however, the 'Subscriber' qualifier implies authenticated access is required, which conflicts with the PR:N in the published vector. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the Uncanny Automator WordPress plugin (versions 7.3.1.2 and earlier) lets unauthenticated remote attackers submit crafted serialized PHP objects that the application deserializes, potentially leading to full WordPress site compromise. The flaw is rooted in unsafe deserialization of untrusted data (CWE-502) and carries high confidentiality, integrity, and availability impact (CVSS 8.1). No public exploit identified at time of analysis and it is not in CISA KEV; the high attack complexity reflects the need for a usable POP gadget chain in the target environment.
Unauthenticated privilege escalation in the Paytium WordPress plugin (Mollie payment forms and donations) through version 5.0.2 allows remote attackers with no authentication to gain elevated privileges, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. The flaw stems from incorrect privilege assignment (CWE-266), meaning a low- or no-privilege actor can be granted rights they should not have. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the CorvusPay WooCommerce Payment Gateway plugin for WordPress (versions 2.7.4 and earlier) lets unauthenticated remote attackers manipulate the payment/integration workflow without valid credentials, per the CVSS 3.1 vector (AV:N/PR:N) and CWE-288. The flaw scores 7.5 with integrity impact only (I:H, C:N, A:N), meaning an attacker can tamper with trusted state - most plausibly forging payment confirmation/callback validation - rather than steal data or take a site down. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Easy Elements for Elementor - Addons & Website Templates WordPress plugin (versions <= 1.4.9) allows remote attackers to gain elevated privileges without authentication, per the CVSS:3.1 vector (PR:N). Classified as CWE-266 (Incorrect Privilege Assignment) and rated CVSS 9.8 with full confidentiality, integrity, and availability impact, the flaw was reported by the Patchstack security team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in Booster for WooCommerce (plugin slug woocommerce-jetpack) versions <= 8.0.1 lets an authenticated customer-level user upload arbitrary files to the WordPress server, enabling web shell deployment and remote code execution. The CVSS 3.1 score of 9.9 reflects a scope change (S:C) where a low-privilege shop customer can fully compromise the underlying host. No public exploit identified at time of analysis; the issue was reported by Patchstack's audit team.
Broken access control in the Paymob for WooCommerce WordPress plugin (versions <= 4.1.2) allows remote unauthenticated attackers to invoke a protected function or action that lacks an authorization check, producing a high integrity impact (CVSS 7.5, CVSS:3.1/.../I:H). The flaw maps to CWE-862 (Missing Authorization), meaning a function reachable over the network performs no capability or ownership validation before acting. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Reflected/stored Cross-Site Scripting in the MapPress Maps for WordPress plugin (versions 2.97.3 and earlier) allows an unauthenticated remote attacker to inject malicious JavaScript that executes in the browser of a victim who interacts with a crafted link or page. Because the CVSS scope is changed (S:C), the injected script can act beyond the vulnerable component to affect logged-in users including administrators. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Abandoned Cart Pro for WooCommerce plugin (versions <= 10.4.0) allows an authenticated low-privileged user (Subscriber) to elevate their own permissions and gain higher-privileged capabilities within the WordPress site. The flaw, reported by Patchstack and classified as CWE-266 (Incorrect Privilege Assignment), carries a CVSS 8.8 and is network-exploitable with low complexity once an attacker holds any minimal account. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in the Fusion Builder WordPress plugin (versions 3.15.4 and earlier) lets a low-privileged authenticated user, such as a Contributor, gain capabilities far beyond their role and effectively act as an administrator. The flaw was reported by Patchstack and carries a CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Fusion Builder is the page builder bundled with the widely sold Avada theme, the exposure spans a large number of WordPress sites that allow self-registration or untrusted contributor accounts.
Unauthorized data exposure in the Stylish Cost Calculator WordPress plugin (versions 8.3.9 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, exposing sensitive information. Reported through Patchstack and classified as a broken access control / missing authorization flaw (CWE-862), it carries a CVSS 7.5 with confidentiality-only impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in the Syncee Premium Dropshipping & Wholesale WordPress plugin (versions <= 1.0.27) lets remote unauthenticated attackers reach functionality that should be access-restricted, exposing confidential information without any login. Reported by Patchstack and tagged as an authentication bypass, the flaw stems from missing authorization checks (CWE-862) on plugin endpoints. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied data, but the CVSS 3.1 base score of 7.5 reflects easy network reach with a high confidentiality impact.
Missing authorization in the Newsletters (newsletters-lite) WordPress plugin through version 4.13 lets unauthenticated remote attackers reach functionality that should be access-controlled, producing limited confidentiality, integrity, and availability impact (CVSS 7.3). Reported by Patchstack and tagged as an authentication bypass, the flaw requires no credentials or user interaction, though no public exploit code or CISA KEV listing exists at time of analysis. The partial (Low) impact across all three dimensions suggests scoped data exposure or unauthorized actions rather than full site compromise.
Sensitive data exposure in the Trinity Backup WordPress plugin (versions 2.0.9 and earlier) allows remote unauthenticated attackers to retrieve confidential information without any credentials. Because the plugin manages full-site backups, the exposed data may include database dumps, configuration files, and credentials. The flaw was reported by Patchstack and carries a CVSS 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the All-In-One Intranet WordPress plugin (versions ≤ 1.8.1) allows unauthenticated remote attackers to bypass the plugin's core 'force login / private site' restriction and read content that is supposed to be visible only to authenticated intranet members. The flaw is a missing authorization check (CWE-862) that undermines the single security feature the plugin exists to provide. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Improper authorization in the Five Star Restaurant Menu WordPress plugin (versions <= 2.5.2) lets unauthenticated remote attackers invoke restricted functionality and modify data without any credentials. The CVSS 3.1 vector (AV:N/PR:N/UI:N) and CWE-862 indicate the plugin exposes one or more actions that lack capability/nonce checks, scored 7.5 with integrity-only impact (C:N/I:H/A:N). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack's audit team and tagged as an Authentication Bypass.
Sensitive data exposure in the WordPress plugin Object Cache 4 everyone (versions 2.3.2 and earlier) lets remote unauthenticated attackers retrieve information the application intended to keep private, per the Patchstack advisory and a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). The flaw, classed as CWE-201, stems from the caching layer inadvertently exposing sensitive cached content to unauthorized requestors. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated backdoor in the WordPress "Enable CORS" plugin (versions <= 2.0.3) lets remote attackers leverage a hard-coded cryptographic key (CWE-321) to bypass access controls and read or alter protected data without any credentials. Reported by Patchstack and tagged as Information Disclosure, the issue carries a CVSS 7.4; no public exploit and no CISA KEV listing exist at the time of analysis, and despite the network attack vector the CVSS marks high attack complexity, indicating exploitation is non-trivial.
Unauthorized data modification in the Gutenverse Companion WordPress plugin (versions 2.5.0 and earlier) lets remote unauthenticated attackers invoke protected functionality due to a missing authorization check. The CVSS 3.1 vector (AV:N/PR:N/UI:N, I:H, C:N, A:N) indicates a network-reachable, no-login integrity compromise rather than data theft or outage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.162) allows remote unauthenticated attackers to inject malicious SQL into backend queries, per Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with PR:N indicates exploitation requires no authentication, and the scope-changed, high-confidentiality rating (S:C/C:H) points to database disclosure beyond the plugin's own data. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the Real Estate 7 WordPress theme (versions up to and including 3.5.9) lets unauthenticated remote attackers inject malicious SQL through an unsanitized parameter, exposing backend database contents. The CVSS 3.1 base score is 9.3 (S:C/C:H) driven by the scope change and high confidentiality impact, with no authentication or user interaction required. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported through Patchstack's vulnerability research program.
Insecure Direct Object Reference in the SupportCandy WordPress helpdesk plugin (versions 3.4.6 and earlier) lets an authenticated low-privilege user (Subscriber) access support tickets and data belonging to other users by manipulating object identifiers, effectively bypassing authorization controls. The flaw carries a CVSS 3.1 base score of 7.6 (PR:L) and was reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis. Because SupportCandy frequently runs on sites with open user registration, the Subscriber prerequisite is often trivially met.
Unauthenticated SQL injection in the wpDataTables WordPress plugin (versions up to and including 7.4) lets remote attackers inject crafted SQL into database queries without any authentication or user interaction, exposing the WordPress backend database. With a CVSS 9.3 (critical) score and a CWE-89 root cause, the flaw enables extraction of sensitive data such as user credentials and configuration secrets. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated information disclosure in the Ads by WPQuads (Quick AdSense Reloaded) WordPress plugin versions 3.0.3 and earlier lets remote attackers read sensitive data without any credentials or user interaction. The flaw, reported by Patchstack and classified as CWE-497, exposes information to an unauthorized control sphere over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the JetBooking WordPress plugin (versions 4.0.4.1 and earlier) lets remote attackers inject crafted SQL into a vulnerable query without any login, exposing the WordPress database. Reported by Patchstack with a CVSS 9.3 (scope-changed, high confidentiality impact), the flaw allows extraction of sensitive data such as user credentials and booking records. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection in the SALESmanago & Leadoo WordPress plugin before 3.11.3 allows low-privileged authenticated users to inject arbitrary SQL through an unsanitised parameter passed to a vulnerable AJAX action. Because the action enforces no authorisation check, even subscriber-level accounts can reach it, and the CVSS scope-changed, high-confidentiality rating (7.7) reflects the ability to read data across the WordPress database. Publicly available exploit code exists (WPScan), though EPSS is low (0.16%) and SSVC classifies exploitation as proof-of-concept only, not active.
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the titles and content of private, draft, and other non-public posts by abusing a REST API endpoint that lacks proper authorization and fails to validate a user-supplied query parameter. WPScan reported the flaw, a public exploit exists, and a vendor patch is available; the CVSS 3.1 score is 7.5 reflecting high confidentiality impact with no integrity or availability effect.
Arbitrary file upload in Daan.Dev's OMGF Pro WordPress plugin (versions through 5.2.6) lets remote attackers upload files of dangerous types, enabling webshell deployment and full site/server takeover. The CVSS 3.1 base score is 10.0 with a scope-changed vector, and the vector's PR:N indicates the flaw is reachable without authentication. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive data exposure in the APIExperts Square for WooCommerce WordPress plugin (also known as woosquare) through version 4.7.3 allows remote attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. Reported by Patchstack and rated CVSS 8.3, the flaw stems from CWE-201 (Insertion of Sensitive Information Into Sent Data) and is exploitable without authentication or user interaction per its CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
SQL injection in the YMC Filter (YMC Smart Filter / Filter Grids) WordPress plugin lets remote attackers inject malicious SQL through unsanitized input, affecting all versions up to and including 3.11.5. Per the CVSS vector (PR:N), exploitation is unauthenticated and network-reachable, enabling database content disclosure and a scope change beyond the plugin's own data. No public exploit identified at time of analysis, and no EPSS score was supplied, so real-world exploitation prevalence is currently unmeasured.
Broken access control in the Royal MCP WordPress plugin (versions up to and including 1.4.25) lets authenticated low-privilege users reach functionality that should be restricted, due to a missing authorization check. With a CVSS of 8.1 and high confidentiality and integrity impact, an attacker holding even a basic account can read and alter data they should not be able to touch. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the Forminator WordPress plugin (versions 1.53.1 and earlier, by WPMU DEV) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, score 7.1) confirms no authentication is required but that user interaction triggers the payload, and the changed scope means the injected script runs in a security context beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed through Patchstack.
PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows an authenticated attacker holding only a low-privilege Subscriber account to inject crafted serialized objects into an unsafe deserialization sink. Depending on the PHP gadget chains present in WordPress core, the plugin, or other installed plugins, this can escalate to data tampering, information disclosure, or remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Patchstack.
Reflected cross-site scripting in the TablePress WordPress plugin (versions 3.3.1 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, including the WordPress admin session context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported through Patchstack's WordPress vulnerability program.
Remote code execution in the Post Snippets WordPress plugin (versions 4.0.19 and earlier) lets an authenticated user with only Contributor-level privileges inject and execute arbitrary PHP/code on the server via the plugin's snippet-handling functionality (CWE-94). Because a low-privilege role can pivot to full server compromise with a scope change (S:C), this is a privilege-escalation-to-RCE flaw reported by Patchstack; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Advanced Order Export For WooCommerce WordPress plugin (by AlgolPlus) affects all versions up to and including 4.0.9, letting a remote attacker inject script that executes in the browser of a victim who views attacker-controlled order/export data. The flaw carries a CVSS 7.1 rating driven by a scope change (attacker script runs outside the vulnerable component's security context) and requires victim interaction; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
Stored or reflected cross-site scripting in the Averta Master Slider WordPress plugin (versions 3.11.2 and earlier) lets unauthenticated remote attackers inject script that executes in a victim's browser, but only after the victim interacts with attacker-supplied content (UI:R). The CVSS:3.1 vector's scope change (S:C) reflects that injected code runs in the browser's trust context rather than the plugin's, enabling session theft or actions on behalf of the victim. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Reflected cross-site scripting in the H5P WordPress plugin (versions 1.17.6 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link, per the CVSS PR:N/UI:R vector. Because the scope is changed (S:C), successful execution can reach beyond the vulnerable component into the authenticated WordPress session context, enabling session/cookie theft or admin-context actions. There is no public exploit identified and the issue is not listed in CISA KEV, so risk is moderate (CVSS 7.1) and contingent on social-engineering a logged-in user.
Stored/reflected Cross-Site Scripting in Melapress's WP Activity Log WordPress plugin (versions <= 5.6.3.1, reported by Patchstack) lets a low-privileged Subscriber-level user inject script that executes in another user's browser, with a CVSS-rated scope change (S:C) meaning the payload can affect resources beyond the plugin's own security context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; direct impact is limited (C:L/I:L/A:L) but the cross-context scope and low attack complexity make it relevant for sites that allow open registration.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.8, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Per its CVSS:3.1 vector (AV:N/PR:N), exploitation is network-reachable and unauthenticated, though the high attack complexity (AC:H) implies non-trivial preconditions. This is classified as information disclosure but rated 8.1 with full C/I/A impact; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.
Missing authorization in the CheckView Automated Testing WordPress plugin (versions 2.1.0 and earlier) lets remote unauthenticated attackers reach functionality that should be access-controlled, enabling unauthorized modification of site data or test/automation state. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, no-interaction flaw with high integrity impact but no confidentiality or availability loss. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in the WC Vendors Marketplace WordPress plugin (versions <= 2.6.8) allows authenticated users holding only a low-privilege Subscriber-level account to inject arbitrary SQL into backend queries. Reported by Patchstack and tracked as CVE-2026-54838 (CWE-89), the flaw carries a CVSS 8.5 with a scope change, reflecting that a minimally-privileged marketplace account can read sensitive data across the WordPress database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization in the Five Star Restaurant Reservations WordPress plugin (version 2.7.19 and earlier) lets remote unauthenticated attackers invoke protected plugin functionality and modify data without holding any account, per the CVSS PR:N vector. The flaw is a broken access control / missing capability check (CWE-862) reported by Patchstack, with a CVSS 3.1 base score of 7.5 driven entirely by integrity impact (C:N/I:H/A:N). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.4.109) lets remote unauthenticated attackers invoke privileged actions they should not reach, due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required, with a high integrity impact but no confidentiality or availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Code injection in the Widget Options WordPress plugin (versions <= 4.2.3, by marketingfire) allows authenticated users holding the low-privileged Contributor role to achieve remote code execution on the host. Because exploitation only requires a Contributor account - a role frequently granted on multi-author and membership sites - an attacker who can register or compromise such an account can run arbitrary PHP and fully take over the site. There is no public exploit identified at time of analysis, but the 9.9 CVSS and CWE-94 classification place this at the most severe end of WordPress plugin flaws.
SQL injection in the WordPress SALESmanago & Leadoo plugin (versions 3.11.2 and earlier) lets authenticated users holding only Subscriber-level privileges inject arbitrary SQL into backend database queries, enabling extraction of sensitive data from the WordPress database. Reported by Patchstack and rated CVSS 8.5, it is dangerous because Subscriber is the lowest authenticated role and is frequently self-registerable on WordPress sites. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Sensitive data exposure in the Visual Link Preview WordPress plugin (versions 2.3.1 and earlier) allows a low-privileged Subscriber-level authenticated user to access information they should not be authorized to view. The CVSS 3.1 vector (PR:L) indicates only minimal authenticated access is needed, and the changed scope reflects data leaking beyond the plugin's intended security boundary. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Broken access control in the MainWP Child WordPress plugin (versions 6.1.1 and earlier) allows remote attackers to invoke privileged actions without proper authorization checks (CWE-862). Because the flaw is reachable without authentication (PR:N) it can be triggered by external attackers, though exploitation depends on tricking a user into an action (UI:R) and on overcoming non-trivial conditions (AC:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the Tourfic WordPress travel-booking plugin (versions through 2.22.7) lets remote attackers read arbitrary database contents via the 'post_id' parameter of the tf_room_availability AJAX action. Because the action is registered for logged-out users (wp_ajax_nopriv) and the required nonce is publicly emitted on single-hotel pages, no authentication is needed in practice. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Stored cross-site scripting in the Email Address Encoder WordPress plugin (free, before 1.0.25) and its Email Encoder Premium counterpart (before 0.3.12) lets unauthenticated visitors inject persistent JavaScript through the plugin's flawed email-replacement handling. Publicly available exploit code exists (disclosed by WPScan) and a vendor patch is available, but it is not in CISA KEV, so there is no public exploit identified as actively used in the wild. Successful exploitation executes attacker script in the browser of any user who later renders the affected page, typically an authenticated administrator.
SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (all versions ≤ 5.0.4) lets unauthenticated remote attackers inject SQL through the 'latitude' and 'longitude' request parameters, enabling extraction of arbitrary database contents such as user credentials, API keys, and order data. The flaw is time-based (blind) and requires no authentication or user interaction, but no public exploit code or active exploitation has been identified at time of analysis. No EPSS or CISA KEV signal was provided in the source data.
Authenticated PHP code injection in the AdRotate Banner Manager WordPress plugin (versions ≤5.17.7) allows Contributor-level users to execute arbitrary PHP on the server by abusing the 'banner' attribute of the [adrotate] shortcode. Exploitation requires W3 Total Cache or Borlabs Cache support to be enabled in AdRotate settings, where unsanitized input is concatenated into a PHP string wrapped in mfunc/fragment cache markers. Reported by Wordfence; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in FunnelKit Funnel Builder for WordPress (versions up to and including 3.15.0.5) allows authenticated attackers with high privileges to inject arbitrary SQL queries against the underlying database. The flaw is reported by Patchstack and tracked as CWE-89; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. The CVSS scope change combined with confidentiality impact indicates database contents beyond the plugin context can be exfiltrated one bit at a time via blind techniques.
Account takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated users to harvest live password reset links for any account, including administrators, by chaining three logic bugs in the member directory subsystem. The flaw enables full site compromise because reset URLs can be used to set new administrator passwords. No public exploit identified at time of analysis, though Wordfence has published detailed technical write-ups that significantly lower the bar for weaponization.
Sensitive information disclosure in the premium Cornerstone page builder (bundled with the X theme) versions 3.0.0 through 7.8.7 allows any authenticated WordPress user to extract raw password hashes and other private user metadata. The CSS-preview request handler fails to enforce capability checks while exposing its required nonce on every wp-admin page, and publicly available exploit code exists per WPScan, though no active exploitation has been reported.