WordPress
Monthly
Reflected cross-site scripting (XSS) in Neoforum version 1.0 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers when they interact with crafted links, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction and authenticated access, limiting its immediate impact but still posing a risk in multi-user forum environments. No patch is currently available.
The Laurent theme for PHP versions 3.1 and earlier contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files on the affected system. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive data outside the intended application directory. No patch is currently available for this vulnerability.
Laurent Core plugin for PHP through version 2.4.1 contains a local file inclusion vulnerability in its filename handling for include/require statements, allowing authenticated attackers to read arbitrary files from the affected system. With a CVSS score of 7.5, this vulnerability enables confidentiality and integrity compromise, though exploitation requires valid credentials and no patch is currently available.
Nelio Content versions 4.1.0 and earlier contain a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary database queries over the network. This vulnerability requires valid user credentials but no user interaction, enabling attackers to read, modify, or delete sensitive database contents. No patch is currently available to address this high-severity flaw.
Omnipress through version 1.6.6 contains a local file inclusion vulnerability in its PHP program that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive files outside the intended directory. This vulnerability requires user interaction but poses significant risk to confidentiality with no available patch at this time.
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated remote code execution through crafted include paths.
QantumThemes Kentha Elementor Widgets kentha-elementor is affected by php remote file inclusion (CVSS 7.5).
Blind SQL injection in shinetheme Traveler versions before 3.2.8 enables authenticated attackers to extract sensitive database information through manipulated SQL queries. An attacker with valid credentials can exploit this vulnerability to read, modify, or delete arbitrary data with no user interaction required. No patch is currently available.
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated attackers to include and execute arbitrary remote PHP files.
A WordPress plugin has a PHP Remote File Inclusion vulnerability enabling unauthenticated remote code execution through crafted include paths.
FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin is affected by sql injection (CVSS 7.6).
wphocus My auctions allegro my-auctions-allegro-free-edition is affected by php remote file inclusion (CVSS 7.5).
Pavothemes Triply versions 2.4.7 and earlier contain a local file inclusion vulnerability in PHP that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters to bypass access controls and potentially execute code or expose sensitive data. No patch is currently available for this vulnerability.
Pavothemes Freshio versions 2.4.2 and earlier contain a local file inclusion vulnerability in PHP that allows unauthenticated remote attackers to read sensitive files on affected systems. The vulnerability stems from improper validation of file paths in include/require statements, enabling disclosure of confidential information such as configuration files and source code. This vulnerability currently lacks a published patch and has a low exploitation prevalence rate.
gregmolnar Simple XML Sitemap simple-xml-sitemap is affected by cross-site request forgery (csrf) (CVSS 7.1).
LA-Studio Element Kit for Elementor WordPress plugin allows unauthenticated admin user creation, enabling complete WordPress site takeover.
PHP object injection in the Nexter Extension plugin for WordPress (versions up to 4.4.6) allows unauthenticated remote attackers to deserialize untrusted data, potentially enabling arbitrary code execution, file deletion, or data theft if a compatible POP chain exists in other installed plugins or themes. The vulnerability has a high CVSS score of 8.1 but currently lacks a public exploit chain in the vulnerable software itself. No patch is currently available.
SQL injection in Koko Analytics for WordPress prior to version 2.1.3 allows unauthenticated attackers to inject malicious SQL through the public tracking endpoint, which gets stored unescaped and executed when administrators export and reimport analytics data. Public exploit code exists for this vulnerability, enabling attackers to execute arbitrary SQL commands including database manipulation and potential data destruction. The vulnerability affects WordPress installations using vulnerable versions of the Koko Analytics plugin and requires administrator interaction with a malicious export file to fully exploit.
Modular DS modular-connector has a CVSS 10.0 privilege escalation vulnerability through incorrect privilege assignment, allowing unauthenticated attackers to gain full administrative access to WordPress sites.
Modular DS WordPress plugin (through 2.5.1) has incorrect privilege assignment allowing unauthenticated privilege escalation. Maximum CVSS 10.0 with scope change, EPSS 6.8%.
PHP Local File Inclusion in G5Theme Handmade Framework versions up to 3.9 enables authenticated attackers to read arbitrary files on the server through improper validation of include/require statements. An attacker with valid credentials can exploit this vulnerability to access sensitive configuration files, source code, or other protected data without requiring user interaction. No patch is currently available for this vulnerability.
Unauthenticated attackers can manipulate WooCommerce orders and expose customer data in the iPaymu Payment Gateway for WooCommerce plugin (versions up to 2.0.2) due to missing webhook signature verification. An attacker can forge payment confirmations to mark orders as paid without actual payment and enumerate order details to harvest PII including customer names, addresses, and purchase history. No patch is currently available.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint when the No-Auth URL feature is enabled. Unauthenticated attackers can extract this token to gain full API access, compromising AI assistant configurations and potentially accessing connected LLM provider API keys.
Unauthenticated privilege escalation in the King Addons for Elementor WordPress plugin (versions 24.12.92 through 51.1.14) allows any remote visitor to create a brand-new account with administrator-level privileges, because the plugin's Login/Register Form AJAX handler accepts a caller-supplied role value without checking it against the roles the site actually permits for self-registration. Because the flaw is network-reachable with no credentials and no user interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a successful request hands the attacker full control of the WordPress installation - content, plugins, themes, and user data. The only practical precondition is that the site exposes the plugin's registration form rather than relying on WordPress core registration; no public exploit identified at time of analysis, and the CVE is not confirmed actively exploited (not in CISA KEV).
The StoryChief WordPress plugin through version 1.0.42 contains an unauthenticated arbitrary file upload via the /wp-json/storychief/webhook REST API endpoint. Insufficient file type validation allows attackers to upload executable PHP files, achieving remote code execution on the WordPress server.
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 66.5%.
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 46.0%.
The AIT CSV Import/Export WordPress plugin through version 3.0.3 allows unauthorized arbitrary file uploads without file type validation. The upload handler in upload-handler.php is accessible without authentication, enabling remote attackers to deploy PHP webshells and achieve code execution on the WordPress server.
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
The Pie Register WordPress plugin versions up to 3.7.1.4 contain an authentication bypass that allows unauthenticated attackers to log in as any user including administrators. By submitting a crafted POST request with social_site=true and a target user_id_social_site value, attackers generate valid WordPress sessions for arbitrary accounts.
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value check on the secret_key in the autheticate_user function. On installations where the plugin API key is not configured, unauthenticated attackers can create administrative accounts and take over the WordPress site.
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.2%.
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.3%.
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WordPress Backup and Migrate Plugin - Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.4%.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.7%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.2%.
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.8%.
Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 63.3%.
Code injection (CWE-94) in the HivePress WordPress plugin, affecting versions through 1.7.32, allows an authenticated user holding only low privileges to influence the generation of executable code on the host site, with the assessed impact falling entirely on confidentiality. Exploitation is network-reachable at low complexity with no user interaction, but it is gated by authentication (CVSS PR:L), so an attacker must first obtain a valid account on the target WordPress installation - fully unauthenticated visitors cannot exploit it. EPSS, CISA KEV, and public exploit-code status were not provided in the source data, so no active-exploitation signal can be asserted; the vendor's fix version is likewise not enumerated in the available input, and remediation details should be confirmed against the Patchstack advisory.
Authentication bypass in the VideoWhisper '2Way VideoCalls and Random Chat' WordPress plugin (webcam-2way-videochat) through version 6.1.5 lets remote attackers reach protected plugin functionality without valid credentials, yielding low confidentiality and integrity impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Because the vector shows no privileges and no user interaction, any network-reachable WordPress site with this plugin active is exposed, though the population at risk is limited to sites that deliberately installed this niche webcam/chat plugin. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Missing authorization in the Kit (formerly ConvertKit) WordPress plugin through 3.4.6 lets unauthenticated remote attackers perform limited unauthorized reads and writes against plugin-managed data and functions. The flaw is a CWE-862 access-control gap rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), affecting default installations with no privileges or user interaction required. No public exploit identified at time of analysis.
Missing authorization in WPExperts Advanced File Manager through 5.4.14 allows network attackers to reach plugin actions that lack proper access-control checks, with limited integrity and availability impact and no confidentiality loss. The Patchstack advisory tags the issue as an authentication bypass; the published CVSS base is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), while the independent assessment rates it PR:L and cautions that realistic exploitation often requires a low-privileged authenticated WordPress account that can access the vulnerable handlers. No public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation was provided.
A broken access control flaw (CWE-862) in the WordPress plugin AI Engine before 3.7.9 lets users holding the Editor role or higher perform AI media management actions against posts they do not own and are not permitted to edit - modifying that content or changing its post type site-wide. Rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), the impact is integrity-only and gated behind a privileged account, so exposure is concentrated in multi-author, agency, or multisite installations that deliberately distrust Editor-level users; single-administrator sites see little practical risk. Publicly available exploit code exists (WPScan published a proof-of-concept entry), but CISA SSVC records no observed exploitation and the vendor has released a fixed version, 3.7.9.
AI Engine WordPress plugin before 3.7.9 allows authenticated users with the Editor role or higher to permanently delete arbitrary posts of any type by passing an object ID they do not own to a media action. The missing ownership/authorization check (CWE-862) lets such users remove navigation menus, block templates, global styles, and other content they cannot normally delete; publicly available exploit code exists. Exploitation requires an Editor+ account, which limits realistic exposure to insider or compromised-account scenarios and keeps this a moderate-priority issue rather than an anonymous internet-facing emergency.
Authenticated Subscriber-level users on WordPress sites running Modern Events Calendar Lite before 7.36.4 can modify the title, content, and excerpt of arbitrary posts, pages, and custom post types because the plugin's post-update handler fails to verify ownership of the target post ID (CWE-639). This integrity-only authorization bypass (CVSS 6.5, PR:L, UI:N) requires only a low-privilege account obtainable where self-registration is enabled; publicly available exploit code exists, but CISA SSVC records no exploitation and the issue is a moderate-priority content-tampering risk rather than an emergency.
Modern Events Calendar Lite before 7.37.0 exposes the personal and payment details of every event booking to any authenticated user, including Subscribers, because its booking-data endpoint lacks capability, nonce, and ownership checks. Publicly available exploit code exists, but exploitation requires a valid low-privilege account, making sites with open registration the most likely targets. The result is a read-only confidentiality breach of names, email addresses, transaction IDs, and payment amounts, assessed as a moderate-priority information disclosure rather than a critical compromise.
Salon Booking System WordPress plugin before 10.31.11 exposes all configured discount coupons-including those hidden from customers-through an insufficiently restricted REST API endpoint reachable by any authenticated user such as a subscriber. The missing authorization check (CWE-284) lets a low-privilege account enumerate coupon codes, amounts, validity dates, and usage limits; publicly available exploit code exists, while the CVSS 4.3 score and PR:L vector reflect limited confidentiality impact. Sites that allow self-registration are the most exposed, though no administrator access, user interaction, or special configuration is required once an account exists.
WordPress sites running the Salon Booking System plugin before 10.31.11 expose an image-import routine that fetches a caller-supplied URL server-side without validation, letting authenticated accounts with the Salon Staff role or higher pull internal-only resources back through the site and plant attacker-named files in a publicly reachable directory. The same write primitive allows storing a malicious SVG that executes JavaScript in the site's origin for anyone who opens it, giving a staff-level account a path to scripts running against higher-privileged users. Publicly available exploit code exists per the WPScan reference, but the privileged-role prerequisite and the victim interaction needed for the script-execution path keep this a moderate-priority issue rather than an emergency; a vendor patch is available in 10.31.11.
Broken access control in the Salon Booking System WordPress plugin before 10.31.11 lets authenticated users who hold the plugin's Salon Staff or Salon Worker role edit arbitrary accounts through the plugin's customers management screen, including demoting administrators to the 'customer' role and overwriting profile fields - resulting in loss of administrative access and possible site lockout. Publicly available exploit code exists, and the vendor has released a fix in version 10.31.11; because the attacker must already hold a staff/worker account, the realistic exposure is insider or compromised-staff-credential abuse rather than unauthenticated remote takeover. The flaw is rated medium severity (CVSS 5.5, CWE-863).
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
Otter Blocks for WordPress before 3.2.3 allows an open redirect through its Stripe Checkout flow because a user-supplied return URL is not validated as belonging to the site, so victims who complete or cancel checkout can be sent to an arbitrary external destination. Publicly available exploit code exists, but exploitation requires the target site to use the vulnerable Stripe Checkout feature and requires victim interaction during checkout, limiting practical impact to phishing-style redirection rather than server compromise.
Unauthenticated attackers can write design-template data into the metadata of arbitrary posts on WordPress sites running the PickPlugins Product Designer for WooCommerce plugin through 1.0.40, because the plugin performs no capability check, inverts its nonce verification, and does not validate the target post ID. Publicly available exploit code exists and remote unauthenticated exploitation works against default installations with no token harvesting or user interaction, though impact is bounded to integrity of post metadata with no confidentiality or availability effect and no direct code execution. EPSS-style risk signals were not provided, and the issue is not reported as part of CISA KEV, so the practical exposure is a moderate-priority data-integrity problem requiring the plugin to be installed and active.
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.
Arbitrary media file deletion in the weForms WordPress plugin (all versions through 1.6.28) lets an unauthenticated attacker poison a form entry's image-upload attachment path with directory-traversal sequences and then persuade an administrator to permanently delete that entry, at which point the plugin unlinks whatever file the traversed path resolves to. The CVSS 5.4 (Medium) score is well-calibrated: the attacker never gains read, execution, or exfiltration capability, impact is limited to files the web server process can unlink, and the mandatory administrator interaction (UI:R) makes end-to-end automation impossible. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical risk concentrates on sites that accept file-upload entries and routinely hard-delete spam-looking submissions.
Reflected cross-site scripting (XSS) in Neoforum version 1.0 and earlier allows authenticated attackers to inject malicious scripts that execute in users' browsers when they interact with crafted links, potentially leading to session hijacking or credential theft. The vulnerability requires user interaction and authenticated access, limiting its immediate impact but still posing a risk in multi-user forum environments. No patch is currently available.
The Laurent theme for PHP versions 3.1 and earlier contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files on the affected system. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive data outside the intended application directory. No patch is currently available for this vulnerability.
Laurent Core plugin for PHP through version 2.4.1 contains a local file inclusion vulnerability in its filename handling for include/require statements, allowing authenticated attackers to read arbitrary files from the affected system. With a CVSS score of 7.5, this vulnerability enables confidentiality and integrity compromise, though exploitation requires valid credentials and no patch is currently available.
Nelio Content versions 4.1.0 and earlier contain a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary database queries over the network. This vulnerability requires valid user credentials but no user interaction, enabling attackers to read, modify, or delete sensitive database contents. No patch is currently available to address this high-severity flaw.
Omnipress through version 1.6.6 contains a local file inclusion vulnerability in its PHP program that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters in include/require statements to access sensitive files outside the intended directory. This vulnerability requires user interaction but poses significant risk to confidentiality with no available patch at this time.
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated remote code execution through crafted include paths.
QantumThemes Kentha Elementor Widgets kentha-elementor is affected by php remote file inclusion (CVSS 7.5).
Blind SQL injection in shinetheme Traveler versions before 3.2.8 enables authenticated attackers to extract sensitive database information through manipulated SQL queries. An attacker with valid credentials can exploit this vulnerability to read, modify, or delete arbitrary data with no user interaction required. No patch is currently available.
A WordPress plugin has a PHP Remote File Inclusion vulnerability (CWE-98) allowing unauthenticated attackers to include and execute arbitrary remote PHP files.
A WordPress plugin has a PHP Remote File Inclusion vulnerability enabling unauthenticated remote code execution through crafted include paths.
FireStorm Plugins FireStorm Professional Real Estate fs-real-estate-plugin is affected by sql injection (CVSS 7.6).
wphocus My auctions allegro my-auctions-allegro-free-edition is affected by php remote file inclusion (CVSS 7.5).
Pavothemes Triply versions 2.4.7 and earlier contain a local file inclusion vulnerability in PHP that allows authenticated attackers to read arbitrary files on the server. An attacker with valid credentials can manipulate filename parameters to bypass access controls and potentially execute code or expose sensitive data. No patch is currently available for this vulnerability.
Pavothemes Freshio versions 2.4.2 and earlier contain a local file inclusion vulnerability in PHP that allows unauthenticated remote attackers to read sensitive files on affected systems. The vulnerability stems from improper validation of file paths in include/require statements, enabling disclosure of confidential information such as configuration files and source code. This vulnerability currently lacks a published patch and has a low exploitation prevalence rate.
gregmolnar Simple XML Sitemap simple-xml-sitemap is affected by cross-site request forgery (csrf) (CVSS 7.1).
LA-Studio Element Kit for Elementor WordPress plugin allows unauthenticated admin user creation, enabling complete WordPress site takeover.
PHP object injection in the Nexter Extension plugin for WordPress (versions up to 4.4.6) allows unauthenticated remote attackers to deserialize untrusted data, potentially enabling arbitrary code execution, file deletion, or data theft if a compatible POP chain exists in other installed plugins or themes. The vulnerability has a high CVSS score of 8.1 but currently lacks a public exploit chain in the vulnerable software itself. No patch is currently available.
SQL injection in Koko Analytics for WordPress prior to version 2.1.3 allows unauthenticated attackers to inject malicious SQL through the public tracking endpoint, which gets stored unescaped and executed when administrators export and reimport analytics data. Public exploit code exists for this vulnerability, enabling attackers to execute arbitrary SQL commands including database manipulation and potential data destruction. The vulnerability affects WordPress installations using vulnerable versions of the Koko Analytics plugin and requires administrator interaction with a malicious export file to fully exploit.
Modular DS modular-connector has a CVSS 10.0 privilege escalation vulnerability through incorrect privilege assignment, allowing unauthenticated attackers to gain full administrative access to WordPress sites.
Modular DS WordPress plugin (through 2.5.1) has incorrect privilege assignment allowing unauthenticated privilege escalation. Maximum CVSS 10.0 with scope change, EPSS 6.8%.
PHP Local File Inclusion in G5Theme Handmade Framework versions up to 3.9 enables authenticated attackers to read arbitrary files on the server through improper validation of include/require statements. An attacker with valid credentials can exploit this vulnerability to access sensitive configuration files, source code, or other protected data without requiring user interaction. No patch is currently available for this vulnerability.
Unauthenticated attackers can manipulate WooCommerce orders and expose customer data in the iPaymu Payment Gateway for WooCommerce plugin (versions up to 2.0.2) due to missing webhook signature verification. An attacker can forge payment confirmations to mark orders as paid without actual payment and enumerate order details to harvest PII including customer names, addresses, and purchase history. No patch is currently available.
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint when the No-Auth URL feature is enabled. Unauthenticated attackers can extract this token to gain full API access, compromising AI assistant configurations and potentially accessing connected LLM provider API keys.
Unauthenticated privilege escalation in the King Addons for Elementor WordPress plugin (versions 24.12.92 through 51.1.14) allows any remote visitor to create a brand-new account with administrator-level privileges, because the plugin's Login/Register Form AJAX handler accepts a caller-supplied role value without checking it against the roles the site actually permits for self-registration. Because the flaw is network-reachable with no credentials and no user interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a successful request hands the attacker full control of the WordPress installation - content, plugins, themes, and user data. The only practical precondition is that the site exposes the plugin's registration form rather than relying on WordPress core registration; no public exploit identified at time of analysis, and the CVE is not confirmed actively exploited (not in CISA KEV).
The StoryChief WordPress plugin through version 1.0.42 contains an unauthenticated arbitrary file upload via the /wp-json/storychief/webhook REST API endpoint. Insufficient file type validation allows attackers to upload executable PHP files, achieving remote code execution on the WordPress server.
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 66.5%.
The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 46.0%.
The AIT CSV Import/Export WordPress plugin through version 3.0.3 allows unauthorized arbitrary file uploads without file type validation. The upload handler in upload-handler.php is accessible without authentication, enabling remote attackers to deploy PHP webshells and achieve code execution on the WordPress server.
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
The Pie Register WordPress plugin versions up to 3.7.1.4 contain an authentication bypass that allows unauthenticated attackers to log in as any user including administrators. By submitting a crafted POST request with social_site=true and a target user_id_social_site value, attackers generate valid WordPress sessions for arbitrary accounts.
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unauthenticated attackers to elevate their access to administrator level. This is a separate, broader vulnerability than the earlier CVE-2025-3102, affecting more installations since it works even on configured instances.
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value check on the secret_key in the autheticate_user function. On installations where the plugin API key is not configured, unauthenticated attackers can create administrative accounts and take over the WordPress site.
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote attackers to hijack logged-in sessions, including administrator accounts, by recovering weakly protected session credentials. With a 93.13% EPSS score (100th percentile) and publicly available exploit code, this is among the most likely-to-be-exploited vulnerabilities currently tracked. Successful exploitation yields full WordPress site takeover.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.2%.
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.3%.
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WordPress Backup and Migrate Plugin - Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.4%.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.7%.
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.2%.
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.2%.
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.7%.
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.8%.
Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 63.3%.
Code injection (CWE-94) in the HivePress WordPress plugin, affecting versions through 1.7.32, allows an authenticated user holding only low privileges to influence the generation of executable code on the host site, with the assessed impact falling entirely on confidentiality. Exploitation is network-reachable at low complexity with no user interaction, but it is gated by authentication (CVSS PR:L), so an attacker must first obtain a valid account on the target WordPress installation - fully unauthenticated visitors cannot exploit it. EPSS, CISA KEV, and public exploit-code status were not provided in the source data, so no active-exploitation signal can be asserted; the vendor's fix version is likewise not enumerated in the available input, and remediation details should be confirmed against the Patchstack advisory.
Authentication bypass in the VideoWhisper '2Way VideoCalls and Random Chat' WordPress plugin (webcam-2way-videochat) through version 6.1.5 lets remote attackers reach protected plugin functionality without valid credentials, yielding low confidentiality and integrity impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Because the vector shows no privileges and no user interaction, any network-reachable WordPress site with this plugin active is exposed, though the population at risk is limited to sites that deliberately installed this niche webcam/chat plugin. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Missing authorization in the Kit (formerly ConvertKit) WordPress plugin through 3.4.6 lets unauthenticated remote attackers perform limited unauthorized reads and writes against plugin-managed data and functions. The flaw is a CWE-862 access-control gap rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), affecting default installations with no privileges or user interaction required. No public exploit identified at time of analysis.
Missing authorization in WPExperts Advanced File Manager through 5.4.14 allows network attackers to reach plugin actions that lack proper access-control checks, with limited integrity and availability impact and no confidentiality loss. The Patchstack advisory tags the issue as an authentication bypass; the published CVSS base is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), while the independent assessment rates it PR:L and cautions that realistic exploitation often requires a low-privileged authenticated WordPress account that can access the vulnerable handlers. No public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation was provided.
A broken access control flaw (CWE-862) in the WordPress plugin AI Engine before 3.7.9 lets users holding the Editor role or higher perform AI media management actions against posts they do not own and are not permitted to edit - modifying that content or changing its post type site-wide. Rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), the impact is integrity-only and gated behind a privileged account, so exposure is concentrated in multi-author, agency, or multisite installations that deliberately distrust Editor-level users; single-administrator sites see little practical risk. Publicly available exploit code exists (WPScan published a proof-of-concept entry), but CISA SSVC records no observed exploitation and the vendor has released a fixed version, 3.7.9.
AI Engine WordPress plugin before 3.7.9 allows authenticated users with the Editor role or higher to permanently delete arbitrary posts of any type by passing an object ID they do not own to a media action. The missing ownership/authorization check (CWE-862) lets such users remove navigation menus, block templates, global styles, and other content they cannot normally delete; publicly available exploit code exists. Exploitation requires an Editor+ account, which limits realistic exposure to insider or compromised-account scenarios and keeps this a moderate-priority issue rather than an anonymous internet-facing emergency.
Authenticated Subscriber-level users on WordPress sites running Modern Events Calendar Lite before 7.36.4 can modify the title, content, and excerpt of arbitrary posts, pages, and custom post types because the plugin's post-update handler fails to verify ownership of the target post ID (CWE-639). This integrity-only authorization bypass (CVSS 6.5, PR:L, UI:N) requires only a low-privilege account obtainable where self-registration is enabled; publicly available exploit code exists, but CISA SSVC records no exploitation and the issue is a moderate-priority content-tampering risk rather than an emergency.
Modern Events Calendar Lite before 7.37.0 exposes the personal and payment details of every event booking to any authenticated user, including Subscribers, because its booking-data endpoint lacks capability, nonce, and ownership checks. Publicly available exploit code exists, but exploitation requires a valid low-privilege account, making sites with open registration the most likely targets. The result is a read-only confidentiality breach of names, email addresses, transaction IDs, and payment amounts, assessed as a moderate-priority information disclosure rather than a critical compromise.
Salon Booking System WordPress plugin before 10.31.11 exposes all configured discount coupons-including those hidden from customers-through an insufficiently restricted REST API endpoint reachable by any authenticated user such as a subscriber. The missing authorization check (CWE-284) lets a low-privilege account enumerate coupon codes, amounts, validity dates, and usage limits; publicly available exploit code exists, while the CVSS 4.3 score and PR:L vector reflect limited confidentiality impact. Sites that allow self-registration are the most exposed, though no administrator access, user interaction, or special configuration is required once an account exists.
WordPress sites running the Salon Booking System plugin before 10.31.11 expose an image-import routine that fetches a caller-supplied URL server-side without validation, letting authenticated accounts with the Salon Staff role or higher pull internal-only resources back through the site and plant attacker-named files in a publicly reachable directory. The same write primitive allows storing a malicious SVG that executes JavaScript in the site's origin for anyone who opens it, giving a staff-level account a path to scripts running against higher-privileged users. Publicly available exploit code exists per the WPScan reference, but the privileged-role prerequisite and the victim interaction needed for the script-execution path keep this a moderate-priority issue rather than an emergency; a vendor patch is available in 10.31.11.
Broken access control in the Salon Booking System WordPress plugin before 10.31.11 lets authenticated users who hold the plugin's Salon Staff or Salon Worker role edit arbitrary accounts through the plugin's customers management screen, including demoting administrators to the 'customer' role and overwriting profile fields - resulting in loss of administrative access and possible site lockout. Publicly available exploit code exists, and the vendor has released a fix in version 10.31.11; because the attacker must already hold a staff/worker account, the realistic exposure is insider or compromised-staff-credential abuse rather than unauthenticated remote takeover. The flaw is rated medium severity (CVSS 5.5, CWE-863).
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
Otter Blocks for WordPress before 3.2.3 allows an open redirect through its Stripe Checkout flow because a user-supplied return URL is not validated as belonging to the site, so victims who complete or cancel checkout can be sent to an arbitrary external destination. Publicly available exploit code exists, but exploitation requires the target site to use the vulnerable Stripe Checkout feature and requires victim interaction during checkout, limiting practical impact to phishing-style redirection rather than server compromise.
Unauthenticated attackers can write design-template data into the metadata of arbitrary posts on WordPress sites running the PickPlugins Product Designer for WooCommerce plugin through 1.0.40, because the plugin performs no capability check, inverts its nonce verification, and does not validate the target post ID. Publicly available exploit code exists and remote unauthenticated exploitation works against default installations with no token harvesting or user interaction, though impact is bounded to integrity of post metadata with no confidentiality or availability effect and no direct code execution. EPSS-style risk signals were not provided, and the issue is not reported as part of CISA KEV, so the practical exposure is a moderate-priority data-integrity problem requiring the plugin to be installed and active.
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.
Arbitrary media file deletion in the weForms WordPress plugin (all versions through 1.6.28) lets an unauthenticated attacker poison a form entry's image-upload attachment path with directory-traversal sequences and then persuade an administrator to permanently delete that entry, at which point the plugin unlinks whatever file the traversed path resolves to. The CVSS 5.4 (Medium) score is well-calibrated: the attacker never gains read, execution, or exfiltration capability, impact is limited to files the web server process can unlink, and the mandatory administrator interaction (UI:R) makes end-to-end automation impossible. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical risk concentrates on sites that accept file-upload entries and routinely hard-delete spam-looking submissions.