WordPress
Monthly
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
Envira Gallery WordPress plugin versions before 1.16.2 fail to verify the capability WordPress reserves for plugin installation when handling the setup-wizard plugin-installation request, letting an authenticated Multisite subsite Administrator install any WordPress.org-published plugin into the network-shared plugins directory - an action Multisite reserves for the network Super Admin. The issue is gated: it only crosses a privilege boundary on WordPress Multisite networks and requires the attacker to already hold subsite-Administrator credentials (CVSS 3.1 AV:N/AC:L/PR:H/UI:N, assessed with S:C/C:H/I:H/A:H, scored 7.2), and it is not exploitable on standard single-site WordPress where Administrators legitimately install plugins. Publicly available exploit code exists (WPScan-published), and the vendor has released a fixed version 1.16.2.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite marketplace-wide commission, payout, and onboarding settings by sending POST requests to /wp-json/multivendorx/v1/settings, because that REST route is authorized only against the low-privilege edit_stores capability instead of an administrator-level capability (CWE-863). The practical outcome is high integrity impact on marketplace configuration - a vendor can rewrite commission rates and payout rules in its own favor - with no user interaction and no administrator action required, while availability impact remains limited. Exploitation requires the attacker to already hold a vendor account with edit_stores on the target store, so exposure is greatest where vendor registration is open or self-service; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, making this a moderate-priority broken-access-control (privilege boundary) issue rather than a pre-authentication compromise.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Arbitrary file deletion in the ChimpStudio FoodBakery WordPress theme (versions up to and including 4.6) allows an authenticated attacker holding only a Subscriber-level account to delete arbitrary files on the server, with no user interaction required. The underlying path traversal flaw (CWE-22) lets a crafted request escape the intended directory and reach sensitive files such as wp-config.php, so the scope change (S:C) escalates impact beyond availability loss toward full site compromise. Rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit identified at time of analysis, and exploitation is gated by whether the site permits attackers to hold a Subscriber account, which is trivial on sites with open self-registration and meaningfully harder where registration is disabled or restricted.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated remote attackers can delete arbitrary plugin-managed content on any WordPress site running the Forminator form-builder plugin at or below version 1.57.3, because the content-deletion action lacks an authorization check (CWE-862 Missing Authorization). The flaw is trivially reachable: our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (published base 7.5), meaning no credentials, no privileges and no user interaction are required - only that the plugin is installed, active and its endpoint is network-reachable. Impact is destructive only (forms/submissions and associated content can be wiped) with no confidentiality disclosure or code execution, and no public exploit code was identified at time of analysis; there is no CISA KEV listing and no EPSS data was supplied. Sites that have upgraded past 1.57.3 or that do not run Forminator are unaffected.
PHP object injection in WooCommerce Multilingual & Multicurrency 5.5.8 and earlier allows an authenticated user with the shop manager role (or higher) to submit crafted serialized input to a plugin endpoint, potentially leading to high confidentiality, integrity, and availability impact if a usable POP gadget chain is present in the loaded code. The vulnerability carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's own authenticated request, but it is not accessible to anonymous visitors or ordinary customers. No public exploit identified at time of analysis.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated broken access control in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions 1.13.1 and earlier) lets any remote attacker reach plugin endpoints that handle product, inventory, and order functions without holding any WordPress capability or account (CWE-862, CVSS 3.1 7.3). The flaw is network-reachable with low complexity, no authentication (PR:N) and no user interaction (UI:N), so the only practical precondition is that the plugin is installed and active at a vulnerable version; per the assessed vector, the consequence of each exposed action is limited to Low confidentiality, integrity, and availability effects with scope unchanged, meaning the 7.3 reflects broad reachability rather than severe per-request impact. There is no CISA KEV entry and no public exploit identified at time of analysis, and the affected population is bounded to WordPress sites running this specific plugin. Tracking reference: Patchstack advisory for the plugin's 1.13.1 broken access control vulnerability.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Barcode Scanner with Inventory & Order Manager up to version 1.13.1 allows remote attackers to execute arbitrary script in a victim's browser when the victim loads a crafted page or link. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), so no attacker authentication is required but the victim must interact with the payload, and no public exploit has been identified at the time of analysis. Impact can include session theft, content injection, or actions in the victim's authenticated context, and is magnified if the victim is an administrator.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated attackers can plant persistent JavaScript that executes in the browser of every visitor to a WordPress site running the Adwised Web Push Notification plugin through version 2.5.7, because several state-changing plugin operations lack authorization checks and the plugin's secret-comparison routine can be defeated on installations where a secret key was never configured. Publicly available exploit code exists (WPScan published a proof-of-concept write-up), though there is no KEV confirmation of active exploitation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated attack that requires a victim visitor to load an affected page, so real-world impact is bounded by the unconfigured-secret precondition, and hardened installs that have set a secret are not affected.
Stored cross-site scripting in the Adwised Web Push Notification WordPress plugin through version 2.5.7 allows any authenticated user - including a low-privileged subscriber - to overwrite the plugin's site-wide configuration and plant JavaScript that executes for every visitor of every front-end page, administrators included. The plugin performs no capability or nonce check on the configuration-update action and prints the stored settings unescaped inside an inline script block, so exploitation is trivial on any site with open user registration. Publicly available exploit code exists (WPScan reference), no CISA KEV listing has been recorded, and successful abuse yields session theft, administrator account takeover, and persistent compromise of the front end; no vendor-released patch was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Unauthenticated remote attackers can delete arbitrary WordPress options in sites running the Insurify WordPress plugin through version 1.0, due to missing authorization and nonce checks on an AJAX action, potentially taking the site offline and stripping every user of their role. Publicly available exploit code exists, and the vulnerability is remotely exploitable with no authentication required (CVSS 9.1). Any site with the vulnerable plugin active is at risk.
Unauthenticated remote attackers can rewrite arbitrary WordPress site settings through an AJAX action exposed by the Quick Quotes plugin through version 1.0.0, which performs no capability or nonce validation on the request. Successful abuse allows an attacker to change site-wide options - including those that can render the site unreachable - with no authentication, no user interaction, and no non-default configuration required, yielding an assessed CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Publicly available exploit code exists per the WPScan disclosure, though the plugin's obscure deployment footprint limits the broader blast radius; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis.
Privilege escalation in the Crowdfundly WordPress plugin (versions through 2.2.2) allows an attacker who already holds one of the plugin's own low-privileged roles to grant themselves the WordPress administrator role or arbitrary capabilities, resulting in full site takeover. The flaw sits in AJAX actions that lack capability checks, so it is reachable remotely with no victim interaction, but the attacker must first obtain a legitimate low-privilege Crowdfundly account - trivial on sites that permit open self-registration of backers/campaigners, and a hard blocker on sites that restrict account creation. Publicly available exploit code exists (per the WPScan entry), while there is no confirmed active exploitation (CISA KEV); the independent assessment rates this as an authenticated privilege-escalation issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rather than the higher-privilege PR:H rating shown in some feeds.
Unauthenticated remote attackers can overwrite arbitrary WordPress options on any site running the Insurify plugin through version 1.0, because one of the plugin's AJAX actions performs neither a capability (authorization) check nor a nonce/CSRF check - a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no privileges or user interaction required. Exploitation can rewrite site-critical options, take the site offline, and deactivate the plugin itself, and publicly available exploit code exists (per the WPScan report and its exploit-tagged reference); there is no indication of confirmed active exploitation (not listed in CISA KEV). The practical constraint is the plugin's limited deployment footprint, not any technical barrier.
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin cho WooCommerce plugin through 3.4.0, because several of its REST API routes enforce authorization only through a credential that is hardcoded identically in every installation. Exploiting this yields disclosure of the store's payment gateway credentials and customer order data, allows the gateway configuration to be rewritten so that payments are credited to an attacker-controlled destination, and permits unpaid orders to be marked as paid; the same missing authorization additionally allows script to be stored and rendered unescaped on the classic WooCommerce checkout, producing unauthenticated stored XSS. CVSS 3.1 scores this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and publicly available exploit code exists per the WPScan report, while no CISA KEV entry was present in the supplied intelligence.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
Envira Gallery WordPress plugin versions before 1.16.2 fail to verify the capability WordPress reserves for plugin installation when handling the setup-wizard plugin-installation request, letting an authenticated Multisite subsite Administrator install any WordPress.org-published plugin into the network-shared plugins directory - an action Multisite reserves for the network Super Admin. The issue is gated: it only crosses a privilege boundary on WordPress Multisite networks and requires the attacker to already hold subsite-Administrator credentials (CVSS 3.1 AV:N/AC:L/PR:H/UI:N, assessed with S:C/C:H/I:H/A:H, scored 7.2), and it is not exploitable on standard single-site WordPress where Administrators legitimately install plugins. Publicly available exploit code exists (WPScan-published), and the vendor has released a fixed version 1.16.2.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
Privilege escalation in the Mobile Builder WordPress plugin (versions through 1.4.2) allows any authenticated low-privilege user - including a self-registered customer account - to grant themselves the administrator role by writing unrestricted user meta keys through one of the plugin's REST routes. The flaw requires only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) and no administrator interaction, and publicly available exploit code exists according to WPScan. Sites with open user self-registration enabled are the easiest to attack, but any existing low-privilege user can still exploit the vulnerable route; CISA's SSVC rates technical impact as total while noting no observed exploitation and no known automatable exploitation at this time.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite marketplace-wide commission, payout, and onboarding settings by sending POST requests to /wp-json/multivendorx/v1/settings, because that REST route is authorized only against the low-privilege edit_stores capability instead of an administrator-level capability (CWE-863). The practical outcome is high integrity impact on marketplace configuration - a vendor can rewrite commission rates and payout rules in its own favor - with no user interaction and no administrator action required, while availability impact remains limited. Exploitation requires the attacker to already hold a vendor account with edit_stores on the target store, so exposure is greatest where vendor registration is open or self-service; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, making this a moderate-priority broken-access-control (privilege boundary) issue rather than a pre-authentication compromise.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Arbitrary file deletion in the ChimpStudio FoodBakery WordPress theme (versions up to and including 4.6) allows an authenticated attacker holding only a Subscriber-level account to delete arbitrary files on the server, with no user interaction required. The underlying path traversal flaw (CWE-22) lets a crafted request escape the intended directory and reach sensitive files such as wp-config.php, so the scope change (S:C) escalates impact beyond availability loss toward full site compromise. Rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit identified at time of analysis, and exploitation is gated by whether the site permits attackers to hold a Subscriber account, which is trivial on sites with open self-registration and meaningfully harder where registration is disabled or restricted.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated remote attackers can delete arbitrary plugin-managed content on any WordPress site running the Forminator form-builder plugin at or below version 1.57.3, because the content-deletion action lacks an authorization check (CWE-862 Missing Authorization). The flaw is trivially reachable: our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (published base 7.5), meaning no credentials, no privileges and no user interaction are required - only that the plugin is installed, active and its endpoint is network-reachable. Impact is destructive only (forms/submissions and associated content can be wiped) with no confidentiality disclosure or code execution, and no public exploit code was identified at time of analysis; there is no CISA KEV listing and no EPSS data was supplied. Sites that have upgraded past 1.57.3 or that do not run Forminator are unaffected.
PHP object injection in WooCommerce Multilingual & Multicurrency 5.5.8 and earlier allows an authenticated user with the shop manager role (or higher) to submit crafted serialized input to a plugin endpoint, potentially leading to high confidentiality, integrity, and availability impact if a usable POP gadget chain is present in the loaded code. The vulnerability carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's own authenticated request, but it is not accessible to anonymous visitors or ordinary customers. No public exploit identified at time of analysis.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated broken access control in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions 1.13.1 and earlier) lets any remote attacker reach plugin endpoints that handle product, inventory, and order functions without holding any WordPress capability or account (CWE-862, CVSS 3.1 7.3). The flaw is network-reachable with low complexity, no authentication (PR:N) and no user interaction (UI:N), so the only practical precondition is that the plugin is installed and active at a vulnerable version; per the assessed vector, the consequence of each exposed action is limited to Low confidentiality, integrity, and availability effects with scope unchanged, meaning the 7.3 reflects broad reachability rather than severe per-request impact. There is no CISA KEV entry and no public exploit identified at time of analysis, and the affected population is bounded to WordPress sites running this specific plugin. Tracking reference: Patchstack advisory for the plugin's 1.13.1 broken access control vulnerability.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Barcode Scanner with Inventory & Order Manager up to version 1.13.1 allows remote attackers to execute arbitrary script in a victim's browser when the victim loads a crafted page or link. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), so no attacker authentication is required but the victim must interact with the payload, and no public exploit has been identified at the time of analysis. Impact can include session theft, content injection, or actions in the victim's authenticated context, and is magnified if the victim is an administrator.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated sensitive data exposure in the Contact Form 7 - Dynamic Text Extension WordPress plugin (versions up to and including 5.0.7) lets any remote visitor cause the plugin's dynamic-text rendering to return information that was not meant to be disclosed, with high confidentiality impact and no integrity or availability effect (assessed CVSS 3.1 base 7.5). The assessed vector AV:N/AC:L/PR:N/UI:N means no authentication, user interaction, or special configuration is required beyond having the vulnerable plugin installed, active, and reachable on an internet-facing site. Risk is bounded by plugin presence and by whatever sensitive values a site's dynamic-text fields actually render; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.