WordPress
Monthly
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Subscriber-level accounts on WordPress sites running the uListing plugin version 2.2.0 or earlier can invoke a plugin settings-change routine that performs no authorization or capability check, letting the lowest-privileged registered user modify configuration values that should be reserved for administrators (CWE-862, missing authorization). The attack is network-reachable, requires no user interaction and no elevated privilege beyond a valid subscriber session, which is trivial to obtain where open self-registration is enabled - though the CVSS vector (PR:L) confirms an account is a genuine prerequisite. Impact is primarily integrity loss in plugin configuration with some confidentiality and availability exposure (CVSS 3.1 base 7.6 as published; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and the overall picture is a moderate-priority hardening issue rather than an emergency; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated remote code execution in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) at version 1.5.19 and earlier lets any remote attacker run arbitrary PHP code on an affected site with no login, no special configuration, and no user interaction, yielding CVSS 10.0 / 9.8-class impact. Any WordPress installation with this plugin installed and active is exposed; sites that never installed it, or that have upgraded past 1.5.19, are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the low complexity and zero prerequisites make this a genuine high-priority issue rather than a CVSS-inflated paper risk, and full site compromise (including database and backup archives) is the realistic outcome of exploitation.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
Unauthenticated sensitive data exposure in the Web Plura Backup & Restore Manager plugin for WordPress (versions 0.2.25 and earlier) allows remote attackers to read potentially sensitive backup-related information from affected sites. Exploitation requires only that the plugin is installed and active, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirming remote, low-complexity, unauthenticated access with no user interaction; impact is limited to confidentiality (C:H/I:N/A:N). No public exploit identified at time of analysis, and the affected install base is limited to sites running this specific low-footprint plugin.
Authenticated subscribers can delete arbitrary files on WordPress sites running PeepSo versions up to 9.0.5.4 due to a path traversal flaw (CWE-22). This high-severity (CVSS 7.7) vulnerability requires only a low-privilege account, which is easily obtained on sites with open registration, and allows deletion of critical files, potentially leading to site compromise or denial of service. No public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization in the Pubjet WordPress plugin (versions up to and including 5.4.8) allows an authenticated attacker with subscriber-level privileges to change plugin settings, resulting in a high integrity impact (CVSS 7.6). Exploitation requires the target site to permit user registration or the attacker to obtain valid low-privilege credentials, making open registration a primary exposure factor. No public exploit code has been identified at time of analysis, and the flaw is classified as CWE-862 (Missing Authorization).
Broken access control in the Wordable WordPress plugin (versions up to and including 8.2.10) lets any authenticated Subscriber-level account invoke functionality that should be reserved for higher-privileged roles, yielding high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Reported by Patchstack and rooted in a missing-authorization condition (CWE-862), the issue requires the attacker to already hold or be able to register a low-privilege account, so real-world risk is much greater on sites permitting open user self-registration than on sites where account creation is locked down. No public exploit code was identified at the time of analysis, the CVE is not listed in CISA KEV, and no EPSS data was supplied; treated as a genuine priority-tier vulnerability with a meaningful authentication caveat, it warrants prompt review of plugin exposure and user-registration settings.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.
Unauthenticated remote code execution in the Everest Backup WordPress plugin affects all versions through 2.3.13, allowing a network-reachable attacker to inject and execute attacker-controlled code without logging in and without any victim interaction (CVSS 3.1 base 8.1, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, rooted in CWE-94 code injection). The High attack-complexity rating is the key tempering factor: exploitation hinges on a condition the attacker does not fully control - such as a specific plugin state, timing window, or particular configuration/data value reaching the injection sink - so reachability must be validated per site rather than assumed, and no public exploit code was identified and no CISA KEV listing exists at time of analysis. Sites running the plugin at 2.3.13 or earlier and exposing the vulnerable endpoint to the internet should treat this as high priority; sites that have deactivated or removed the plugin, or that gate the endpoint behind network controls, are not exposed.
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Cross-site scripting (XSS) in the Additional Order Filters for WooCommerce plugin (versions 1.24 and earlier) allows unauthenticated attackers to inject malicious JavaScript into order-filter pages, which executes in the browser of a logged-in shop manager or administrator who interacts with the affected page (UI:R). The assessed impact is confined to the browser/session context (C:L/I:L/A:N), making this a moderate-priority issue rather than a top-tier emergency; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Privilege escalation in the miniOrange OTP Verification WordPress plugin through 5.5.7 allows an attacker to gain elevated privileges on affected sites; the supplied CVSS 3.1 vector scores it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), describing a remote, unauthenticated, low-complexity flaw, though the incorrect privilege assignment (CWE-266) may in practice require a low-privileged authenticated account and authentication requirements are not confirmed from available data. No public exploit code or active exploitation (CISA KEV) is identified in the provided intelligence.
Privilege escalation in the WPMU DEV Forminator WordPress plugin affects every release through 1.57.3 and lets an attacker abuse incorrect privilege assignment logic to obtain capabilities beyond those granted to their account, resulting in high integrity impact and some availability impact. Our independent assessment scores the issue using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, i.e. network-reachable, low complexity and no user interaction, but with PR:L rather than the vendor-reported PR:N, meaning a low-privileged account is the more likely precondition and any site offering low-privilege registration should treat this as high priority. There is confirmed actively exploited? No - no KEV listing, and no public exploit identified at time of analysis, so this should be prioritized on the basis of the privilege-escalation class and the wide install base of the plugin rather than on observed attacks.
Attackers can delete arbitrary files outside the intended directory in rtMedia for WordPress, BuddyPress and bbPress (buddypress-media) versions up to 4.7.13 due to a path traversal flaw, causing high integrity and availability impact. The published CVSS score is 9.8, but our assessment indicates a likely authenticated vector (PR:L) and no confidentiality impact; authentication requirements are not confirmed from available data. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry.
Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal.
Privilege escalation in WooCommerce 9.8.0 through 11.1.2 lets an attacker who already holds an authenticated high-privilege store account obtain capabilities beyond those legitimately assigned to that role, with full impact to store confidentiality, integrity and availability (CVSS 7.2). The underlying defect is an Incorrect Privilege Assignment (CWE-266) that is reachable over the network with low attack complexity and no user interaction, but the CVSS vector (PR:H) means anonymous internet attackers are excluded - a legitimate elevated account such as a shop manager or other non-administrator role is the prerequisite. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited with the report and the realistic attack surface is largest on multi-vendor, multi-staff, or delegated-administration stores.
Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
Reflected cross-site scripting (XSS) in the WPAdverts WordPress plugin through version 2.3.4 allows unauthenticated attackers to inject malicious scripts via crafted URLs, which execute in a victim's browser when the link is clicked. The flaw requires user interaction (UI:R) and is non-persistent, making exploitation dependent on social engineering; no public exploit code is identified at time of analysis. Successful attacks can compromise the victim's session or perform actions on their behalf, with heightened risk if the victim is an administrator.
Stored cross-site scripting in the WPAdverts WordPress plugin (all versions through 2.3.4) lets an attacker place crafted script content into advert data that is later rendered without proper neutralization, so the payload executes in the browser of any user who views the affected advert page. The reported base score is 7.1 (moderate); our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires a low-privileged, authenticated submitter plus victim interaction, and the divergence from the published PR:N vector means the true privilege requirement hinges on whether WPAdverts is configured to allow unauthenticated advert submissions. No public exploit was identified at time of analysis, and no patch version is specified in the available intelligence, so the exposure is real but not confirmed actively abused.
PHP object injection in the Tainacan WordPress plugin (all versions through 1.3.0) allows an authenticated high-privilege user - per the assessed CVSS vector (PR:H), effectively a WordPress administrator or an equivalent role able to reach the vulnerable input - to pass attacker-controlled serialized data into the plugin's deserialization path and potentially instantiate arbitrary PHP objects. Rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the flaw carries high confidentiality and integrity impact but is sharply constrained by the privileged authentication prerequisite and the plugin's niche use as a digital repository/collection management tool for WordPress. No public exploit code or confirmed active exploitation was identified at time of analysis, and object injection would additionally require a usable POP/gadget chain in the loaded codebase to convert into concrete code execution or file manipulation.
Authenticated attackers can exploit a PHP Object Injection flaw (CWE-502) in the WordPress plugin Slider by 10Web (slider-wd) versions up to 1.2.62, potentially achieving remote code execution, file manipulation, or data tampering if a suitable POP gadget chain is present. The vulnerability requires low-privilege authentication (CVSS PR:L) and network access with no user interaction, but its real-world impact is contingent on the availability of a gadget chain in WordPress core or other installed components. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in the Forminator WordPress plugin (WPMU DEV) through version 1.57.3 lets an unauthenticated attacker submit crafted form input that is persisted and later rendered without output encoding, executing script in the browser of whoever views it - typically an administrator reviewing submissions in wp-admin. The injection itself requires no account (CVSS PR:N) but exploitation depends on a victim viewing the stored content (UI:R), and with a changed scope (S:C) the impact is limited to low confidentiality, integrity and availability rather than direct server compromise. No public exploit code has been identified at time of analysis, and the overall assessment rates this a moderate-priority issue rather than an urgent one, though EPSS and KEV signals are absent from the supplied data.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.31) allows unauthenticated attackers to inject arbitrary JavaScript into front-end user profiles by supplying a crafted value for a custom text-type user attribute, which then executes whenever a victim - including an administrator - views the injected profile page. Exploitation is gated on two administrator-controlled configuration choices: a text-type custom user attribute must use a display format that places %value% inside an HTML attribute context (the plugin's own documented pattern <a href="%value%">Custom link</a>), and front-end user profiles must be enabled; sites that do not meet both conditions are not exploitable despite the HIGH base score. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor fix is available in HivePress 1.7.32.
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPAdverts - Classifieds Plugin for WordPress (all versions up to and including 2.3.4) allows attackers to persist arbitrary JavaScript in the 'adverts_location' advert field, which then executes in the browser of any user - typically an administrator - who views the affected classified listing. Because the plugin stores the field without sanitization and renders it without output escaping in its block-based listing templates, the assessment vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) treats the attack as unauthenticated, though in practice this holds only on sites that allow anonymous or public ad submission; if registration or pre-publish moderation is enforced, the attacker needs at least a low-privileged account or must rely on an administrator reviewing the pending ad. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this rates as a moderate, not emergency, priority - the realistic worst case is administrator session compromise when an admin browses the poisoned listing.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Authentication bypass in the WPCOM Member WordPress plugin (all versions up to and including 1.7.27) allows remote, unauthenticated attackers to establish a fully authenticated WordPress session as any user, including administrators, by forging a session entry that the plugin's social-login callback later resolves to a victim's bound social identifier. The published CVSS is 9.8, but independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: exploitation is gated by two real-world prerequisites - the target must have at least one social login provider configured (which is what registers the vulnerable callback on the WordPress init hook), and the attacker must know or be able to enumerate the victim account's bound openid/unionid, with admin takeover specifically requiring the administrator's identifier. Cross-referenced sources show no CISA KEV entry and no public exploit code identified at time of analysis, so the practical risk is best characterized as a genuine high-priority issue whose severity is tempered by the non-universal configuration requirement and the prior-knowledge hurdle rather than a universally exploitable 9.8.
Stored DOM-based cross-site scripting in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress plugin (free build, versions up to and including 5.2.12) lets unauthenticated attackers inject arbitrary web scripts via the href attribute inside comment content, which then execute in the browser of any visitor who loads the affected page. The flaw is confined to the free build: because Plugin::has_pro() returns false, the author-filter rewriter never appends its ?m_bm=true marker to plugin-generated anchors, so every href the byline script selects and rewrites is fully attacker-controlled. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) and no public exploit code identified at time of analysis.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Unauthenticated stored cross-site scripting (XSS) in FunnelKit - Funnel Builder for WooCommerce Checkout versions up to and including 3.16.0.5 allows attackers to inject malicious scripts via the 'shipping_first_name' checkout parameter, which are then executed when a user views the affected thank-you page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's e-commerce tracking code. No public exploit code or active exploitation has been identified at this time, and the risk is considered notable but not top-priority given the need for a victim to view the injected page. This affects any WooCommerce store using the vulnerable plugin with a publicly reachable checkout flow.
Stored cross-site scripting in the WP Photo Album Plus WordPress plugin affects all versions up to and including 9.3.03.002 and can be triggered by remote attackers without authentication, since the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N. The plugin records session history derived from REQUEST_URI without adequate sanitization, and because esc_url_raw() strips literal angle brackets while preserving HTML entities, the plugin's own wppaEntityDecode() routine later converts those entities back into live markup that is rendered through jQuery('#wppa-modal-container').html(). The stored script executes only when a victim subsequently loads a page that renders the poisoned modal container, which is the practical limiting factor; the base score of 7.2 (HIGH) reflects scope change with limited confidentiality and integrity impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Unauthenticated cross-site scripting in the WordPress plugin Document Embedder (bplugins) at versions up to and including 2.4.0 allows an attacker to have arbitrary JavaScript execute in the browser of a site visitor or administrator who opens a crafted link or page containing malicious embed content; no account on the target WordPress site is required (PR:N), but the victim must interact with attacker-supplied content (UI:R), which is the primary limiting factor. The flaw is a CWE-79 input-neutralization failure in how the plugin renders embedded documents, and carries a CVSS 3.1 base score of 7.1; there is no public exploit identified at time of analysis, and it is not listed as confirmed actively exploited (CISA KEV), although the reporting source is a commercial vulnerability intelligence vendor (Patchstack) that maintains a WordPress-focused advisory database. Because successful script execution occurs in the context of the affected site's origin (scope change, S:C), a compromised administrator session could be leveraged to perform privileged actions, though the low confidentiality and integrity sub-scores reflect limited direct data exposure per request.
Unauthenticated cross-site scripting in the WordPress plugin Before After Image Comparison - Image Comparison for WP (versions 1.1.21 and earlier) allows a remote attacker to deliver a crafted payload that executes JavaScript in a victim's browser, but only after that victim interacts with the attacker-supplied link or page (CVSS 3.1 base 7.1, HIGH). The vulnerable plugin must be installed and active on the target WordPress site for any exploitation to be possible; sites not running it are unaffected. At the time of analysis there is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified, and no EPSS score was supplied, so the practical risk is governed mainly by the mandatory user interaction and the need for the specific plugin to be present and reachable.
Subscriber-level accounts on WordPress sites running the uListing plugin version 2.2.0 or earlier can invoke a plugin settings-change routine that performs no authorization or capability check, letting the lowest-privileged registered user modify configuration values that should be reserved for administrators (CWE-862, missing authorization). The attack is network-reachable, requires no user interaction and no elevated privilege beyond a valid subscriber session, which is trivial to obtain where open self-registration is enabled - though the CVSS vector (PR:L) confirms an account is a genuine prerequisite. Impact is primarily integrity loss in plugin configuration with some confidentiality and availability exposure (CVSS 3.1 base 7.6 as published; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and the overall picture is a moderate-priority hardening issue rather than an emergency; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Unauthenticated cross-site scripting in the Slider by 10Web WordPress plugin (slider-wd) affects all versions up to and including 1.2.63, allowing remote attackers to inject script that executes in a victim's browser session on the affected site. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - no privileges are required to originate the payload, but exploitation is not self-propagating: it depends on a human in the loop, since the victim must open an attacker-supplied request or crafted link (UI:R) for the script to run, and the vulnerable code path is only reachable while the plugin is installed and active. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and unauthenticated attack surface make prompt patching or deactivation advisable for sites running the plugin.
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated remote code execution in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) at version 1.5.19 and earlier lets any remote attacker run arbitrary PHP code on an affected site with no login, no special configuration, and no user interaction, yielding CVSS 10.0 / 9.8-class impact. Any WordPress installation with this plugin installed and active is exposed; sites that never installed it, or that have upgraded past 1.5.19, are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the low complexity and zero prerequisites make this a genuine high-priority issue rather than a CVSS-inflated paper risk, and full site compromise (including database and backup archives) is the realistic outcome of exploitation.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
Cross-site scripting in the Qode Real Estate WordPress plugin (all versions up to and including 1.1.7.3) lets unauthenticated attackers deliver crafted input that executes as script in a victim's browser session on the affected site. Exploitation requires no authentication but does require victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - a victim must click a crafted link or load attacker-influenced content before the payload runs, so there is no silent server-side compromise. No public exploit identified at time of analysis and no CISA KEV listing; signals are mixed and lean toward moderate rather than urgent priority, and the exact injectable parameter is not detailed in the available description so the Patchstack advisory should be consulted for the precise entry point.
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
Unauthenticated sensitive data exposure in the Web Plura Backup & Restore Manager plugin for WordPress (versions 0.2.25 and earlier) allows remote attackers to read potentially sensitive backup-related information from affected sites. Exploitation requires only that the plugin is installed and active, per the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirming remote, low-complexity, unauthenticated access with no user interaction; impact is limited to confidentiality (C:H/I:N/A:N). No public exploit identified at time of analysis, and the affected install base is limited to sites running this specific low-footprint plugin.
Authenticated subscribers can delete arbitrary files on WordPress sites running PeepSo versions up to 9.0.5.4 due to a path traversal flaw (CWE-22). This high-severity (CVSS 7.7) vulnerability requires only a low-privilege account, which is easily obtained on sites with open registration, and allows deletion of critical files, potentially leading to site compromise or denial of service. No public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization in the Pubjet WordPress plugin (versions up to and including 5.4.8) allows an authenticated attacker with subscriber-level privileges to change plugin settings, resulting in a high integrity impact (CVSS 7.6). Exploitation requires the target site to permit user registration or the attacker to obtain valid low-privilege credentials, making open registration a primary exposure factor. No public exploit code has been identified at time of analysis, and the flaw is classified as CWE-862 (Missing Authorization).
Broken access control in the Wordable WordPress plugin (versions up to and including 8.2.10) lets any authenticated Subscriber-level account invoke functionality that should be reserved for higher-privileged roles, yielding high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Reported by Patchstack and rooted in a missing-authorization condition (CWE-862), the issue requires the attacker to already hold or be able to register a low-privilege account, so real-world risk is much greater on sites permitting open user self-registration than on sites where account creation is locked down. No public exploit code was identified at the time of analysis, the CVE is not listed in CISA KEV, and no EPSS data was supplied; treated as a genuine priority-tier vulnerability with a meaningful authentication caveat, it warrants prompt review of plugin exposure and user-registration settings.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Broken access control in the WPSection WordPress plugin through version 1.5.1 allows an authenticated subscriber-level user to perform privileged actions that should be restricted to higher-privileged roles, resulting in high integrity and availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The flaw is a missing authorization check (CWE-862): the plugin does not verify that the calling user holds the capability the action demands, so any valid low-privileged account on an affected site - the description explicitly cites the Subscriber role - can trigger the vulnerable code paths without user interaction. Only sites running WPSection 1.5.1 or earlier that allow subscriber-level or comparable self-registration are realistically exposed, since an anonymous visitor cannot reach the functionality; no public exploit identified at time of analysis, and the plugin's narrow deployment base limits mass exploitation.
Unauthenticated remote code execution in the Everest Backup WordPress plugin affects all versions through 2.3.13, allowing a network-reachable attacker to inject and execute attacker-controlled code without logging in and without any victim interaction (CVSS 3.1 base 8.1, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, rooted in CWE-94 code injection). The High attack-complexity rating is the key tempering factor: exploitation hinges on a condition the attacker does not fully control - such as a specific plugin state, timing window, or particular configuration/data value reaching the injection sink - so reachability must be validated per site rather than assumed, and no public exploit code was identified and no CISA KEV listing exists at time of analysis. Sites running the plugin at 2.3.13 or earlier and exposing the vulnerable endpoint to the internet should treat this as high priority; sites that have deactivated or removed the plugin, or that gate the endpoint behind network controls, are not exposed.
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Cross-site scripting (XSS) in the Additional Order Filters for WooCommerce plugin (versions 1.24 and earlier) allows unauthenticated attackers to inject malicious JavaScript into order-filter pages, which executes in the browser of a logged-in shop manager or administrator who interacts with the affected page (UI:R). The assessed impact is confined to the browser/session context (C:L/I:L/A:N), making this a moderate-priority issue rather than a top-tier emergency; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the WP File Download WordPress plugin (versions up to and including 6.3.6) allows remote attackers to inject malicious scripts into a victim's browser session, potentially leading to session hijacking, data theft, or site defacement, though meaningful impact requires luring a privileged user. The flaw requires user interaction (e.g., clicking a crafted link) and affects any WordPress site using this JoomUnited plugin; no public exploit code has been identified at time of analysis, and the CVSS score is 7.1 (moderate severity).
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Privilege escalation in the miniOrange OTP Verification WordPress plugin through 5.5.7 allows an attacker to gain elevated privileges on affected sites; the supplied CVSS 3.1 vector scores it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), describing a remote, unauthenticated, low-complexity flaw, though the incorrect privilege assignment (CWE-266) may in practice require a low-privileged authenticated account and authentication requirements are not confirmed from available data. No public exploit code or active exploitation (CISA KEV) is identified in the provided intelligence.
Privilege escalation in the WPMU DEV Forminator WordPress plugin affects every release through 1.57.3 and lets an attacker abuse incorrect privilege assignment logic to obtain capabilities beyond those granted to their account, resulting in high integrity impact and some availability impact. Our independent assessment scores the issue using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, i.e. network-reachable, low complexity and no user interaction, but with PR:L rather than the vendor-reported PR:N, meaning a low-privileged account is the more likely precondition and any site offering low-privilege registration should treat this as high priority. There is confirmed actively exploited? No - no KEV listing, and no public exploit identified at time of analysis, so this should be prioritized on the basis of the privilege-escalation class and the wide install base of the plugin rather than on observed attacks.
Attackers can delete arbitrary files outside the intended directory in rtMedia for WordPress, BuddyPress and bbPress (buddypress-media) versions up to 4.7.13 due to a path traversal flaw, causing high integrity and availability impact. The published CVSS score is 9.8, but our assessment indicates a likely authenticated vector (PR:L) and no confidentiality impact; authentication requirements are not confirmed from available data. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry.
Unauthenticated code injection in the VillaTheme 'Thank You Page Customizer for WooCommerce' plugin, versions up to and including 1.2.3, lets a remote attacker who can reach a site running the plugin cause arbitrary code to be generated and executed, primarily threatening the integrity of the WordPress installation (CVSS 3.1 base 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per independent assessment). Any store that has both WooCommerce and this specific plugin installed and active is exposed, requires no credentials or user interaction, and is exploitable against default configurations. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and no vendor-released fixed version was found in the available data, so the practical risk is bounded by the narrow deployment scope of this relatively uncommon plugin rather than by any mass-exploitation signal.
Privilege escalation in WooCommerce 9.8.0 through 11.1.2 lets an attacker who already holds an authenticated high-privilege store account obtain capabilities beyond those legitimately assigned to that role, with full impact to store confidentiality, integrity and availability (CVSS 7.2). The underlying defect is an Incorrect Privilege Assignment (CWE-266) that is reachable over the network with low attack complexity and no user interaction, but the CVSS vector (PR:H) means anonymous internet attackers are excluded - a legitimate elevated account such as a shop manager or other non-administrator role is the prerequisite. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited with the report and the realistic attack surface is largest on multi-vendor, multi-staff, or delegated-administration stores.
Missing authorization checks in the Bayarcash WooCommerce WordPress plugin (all versions through 4.4.2) let unauthenticated remote attackers reach functionality that should be restricted to privileged users, allowing unauthorized changes to payment-related configuration or transaction state. The flaw carries CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), i.e. network-reachable, low complexity, no credentials and no user interaction, with a pure integrity impact and no confidentiality loss or denial of service. Exposure is bounded by deployment scope rather than configuration: the site must be running the plugin, and because Bayarcash is a Malaysia-focused payment gateway the realistic victim set is merchants using that gateway. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
Reflected cross-site scripting (XSS) in the WPAdverts WordPress plugin through version 2.3.4 allows unauthenticated attackers to inject malicious scripts via crafted URLs, which execute in a victim's browser when the link is clicked. The flaw requires user interaction (UI:R) and is non-persistent, making exploitation dependent on social engineering; no public exploit code is identified at time of analysis. Successful attacks can compromise the victim's session or perform actions on their behalf, with heightened risk if the victim is an administrator.
Stored cross-site scripting in the WPAdverts WordPress plugin (all versions through 2.3.4) lets an attacker place crafted script content into advert data that is later rendered without proper neutralization, so the payload executes in the browser of any user who views the affected advert page. The reported base score is 7.1 (moderate); our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires a low-privileged, authenticated submitter plus victim interaction, and the divergence from the published PR:N vector means the true privilege requirement hinges on whether WPAdverts is configured to allow unauthenticated advert submissions. No public exploit was identified at time of analysis, and no patch version is specified in the available intelligence, so the exposure is real but not confirmed actively abused.
PHP object injection in the Tainacan WordPress plugin (all versions through 1.3.0) allows an authenticated high-privilege user - per the assessed CVSS vector (PR:H), effectively a WordPress administrator or an equivalent role able to reach the vulnerable input - to pass attacker-controlled serialized data into the plugin's deserialization path and potentially instantiate arbitrary PHP objects. Rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the flaw carries high confidentiality and integrity impact but is sharply constrained by the privileged authentication prerequisite and the plugin's niche use as a digital repository/collection management tool for WordPress. No public exploit code or confirmed active exploitation was identified at time of analysis, and object injection would additionally require a usable POP/gadget chain in the loaded codebase to convert into concrete code execution or file manipulation.
Authenticated attackers can exploit a PHP Object Injection flaw (CWE-502) in the WordPress plugin Slider by 10Web (slider-wd) versions up to 1.2.62, potentially achieving remote code execution, file manipulation, or data tampering if a suitable POP gadget chain is present. The vulnerability requires low-privilege authentication (CVSS PR:L) and network access with no user interaction, but its real-world impact is contingent on the availability of a gadget chain in WordPress core or other installed components. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in the Forminator WordPress plugin (WPMU DEV) through version 1.57.3 lets an unauthenticated attacker submit crafted form input that is persisted and later rendered without output encoding, executing script in the browser of whoever views it - typically an administrator reviewing submissions in wp-admin. The injection itself requires no account (CVSS PR:N) but exploitation depends on a victim viewing the stored content (UI:R), and with a changed scope (S:C) the impact is limited to low confidentiality, integrity and availability rather than direct server compromise. No public exploit code has been identified at time of analysis, and the overall assessment rates this a moderate-priority issue rather than an urgent one, though EPSS and KEV signals are absent from the supplied data.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.31) allows unauthenticated attackers to inject arbitrary JavaScript into front-end user profiles by supplying a crafted value for a custom text-type user attribute, which then executes whenever a victim - including an administrator - views the injected profile page. Exploitation is gated on two administrator-controlled configuration choices: a text-type custom user attribute must use a display format that places %value% inside an HTML attribute context (the plugin's own documented pattern <a href="%value%">Custom link</a>), and front-end user profiles must be enabled; sites that do not meet both conditions are not exploitable despite the HIGH base score. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor fix is available in HivePress 1.7.32.
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Unauthenticated attackers can retrieve any customer's invoice, packing slip, delivery note, dispatch label or shipping label from WordPress sites running the WebToffee WooCommerce PDF Invoices plugin up to and including 5.0.2, exposed via the guest 'print_document_from_the_mail_link' handler. The handler authenticates document access by comparing a base64-encoded 'email' parameter against the order's billing email - a non-secret identifier - rather than the secret WooCommerce order_key, so anyone who knows a target order ID and that order's billing email can pull the full document contents (name, billing/shipping address, phone, products, prices, taxes, invoice metadata). Exploitation requires the site to be configured with guest document access ('wt_pklist_print_button_access_for' != 'logged_in'), so default logged-in-only configurations are not exposed; risk is rated CVSS 7.5 with high confidentiality impact but no integrity or availability impact, and no public exploit code has been identified at time of analysis.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPAdverts - Classifieds Plugin for WordPress (all versions up to and including 2.3.4) allows attackers to persist arbitrary JavaScript in the 'adverts_location' advert field, which then executes in the browser of any user - typically an administrator - who views the affected classified listing. Because the plugin stores the field without sanitization and renders it without output escaping in its block-based listing templates, the assessment vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) treats the attack as unauthenticated, though in practice this holds only on sites that allow anonymous or public ad submission; if registration or pre-publish moderation is enforced, the attacker needs at least a low-privileged account or must rely on an administrator reviewing the pending ad. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this rates as a moderate, not emergency, priority - the realistic worst case is administrator session compromise when an admin browses the poisoned listing.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Authentication bypass in the WPCOM Member WordPress plugin (all versions up to and including 1.7.27) allows remote, unauthenticated attackers to establish a fully authenticated WordPress session as any user, including administrators, by forging a session entry that the plugin's social-login callback later resolves to a victim's bound social identifier. The published CVSS is 9.8, but independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: exploitation is gated by two real-world prerequisites - the target must have at least one social login provider configured (which is what registers the vulnerable callback on the WordPress init hook), and the attacker must know or be able to enumerate the victim account's bound openid/unionid, with admin takeover specifically requiring the administrator's identifier. Cross-referenced sources show no CISA KEV entry and no public exploit code identified at time of analysis, so the practical risk is best characterized as a genuine high-priority issue whose severity is tempered by the non-universal configuration requirement and the prior-knowledge hurdle rather than a universally exploitable 9.8.
Stored DOM-based cross-site scripting in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress plugin (free build, versions up to and including 5.2.12) lets unauthenticated attackers inject arbitrary web scripts via the href attribute inside comment content, which then execute in the browser of any visitor who loads the affected page. The flaw is confined to the free build: because Plugin::has_pro() returns false, the author-filter rewriter never appends its ?m_bm=true marker to plugin-generated anchors, so every href the byline script selects and rewrites is fully attacker-controlled. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) and no public exploit code identified at time of analysis.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Unauthenticated stored cross-site scripting (XSS) in FunnelKit - Funnel Builder for WooCommerce Checkout versions up to and including 3.16.0.5 allows attackers to inject malicious scripts via the 'shipping_first_name' checkout parameter, which are then executed when a user views the affected thank-you page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's e-commerce tracking code. No public exploit code or active exploitation has been identified at this time, and the risk is considered notable but not top-priority given the need for a victim to view the injected page. This affects any WooCommerce store using the vulnerable plugin with a publicly reachable checkout flow.
Stored cross-site scripting in the WP Photo Album Plus WordPress plugin affects all versions up to and including 9.3.03.002 and can be triggered by remote attackers without authentication, since the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N. The plugin records session history derived from REQUEST_URI without adequate sanitization, and because esc_url_raw() strips literal angle brackets while preserving HTML entities, the plugin's own wppaEntityDecode() routine later converts those entities back into live markup that is rendered through jQuery('#wppa-modal-container').html(). The stored script executes only when a victim subsequently loads a page that renders the poisoned modal container, which is the practical limiting factor; the base score of 7.2 (HIGH) reflects scope change with limited confidentiality and integrity impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.