WordPress
Monthly
Stored DOM-based cross-site scripting in the YMC Smart Filter plugin for WordPress (all versions through 3.12.19) allows a user with Author-level access or higher to plant script inside a post title that is later rendered unsafely by the plugin's front-end search widget, executing in the browser of anyone who views the injected page or types into the filter search box. The autocomplete REST search endpoint registers a permission callback that unconditionally returns true, so triggering the payload requires no authentication whatsoever, while only Author-level capability is needed to store it; this mismatch is reflected in the CVSS scope change (S:C) and the PR:L rating. Impact is limited to client-side script execution in the visitor's session (C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the primary exposure limiter is whether a site hands Author accounts to untrusted users.
Unauthenticated information disclosure and click-statistics manipulation in the ThirstyAffiliates WordPress plugin before 3.12.1 lets remote attackers query the plugin's link redirect tracking handler to reveal destination URLs of unpublished affiliate links and to record fabricated clicks. The issue affects WordPress sites running the plugin with its redirect/click-tracking handler reachable, requires no credentials or user interaction, and is fixed in vendor release 3.12.1; no public exploit was identified at time of analysis.
CSRF in the Patreon WordPress plugin before 1.10.0 allows remote attackers to re-link a WordPress site's Patreon integration to an attacker-controlled Patreon account by tricking a logged-in administrator into loading a crafted request, because the account-connect action does not verify a nonce. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation needs a victim administrator with an active session and the plugin's Patreon connect feature in use, but no attacker authentication. Impact is limited to integrity - takeover of the site's Patreon integration, with no direct code execution or data disclosure reported; no public exploit was identified at time of analysis, and a vendor fix is available in 1.10.0.
Open redirect in the Patreon WordPress plugin before 1.10.0 allows unauthenticated attackers to craft links that send visitors to arbitrary external sites after they click, enabling phishing that abuses the trusted WordPress site's domain. Exploitation requires user interaction (UI:R) and is limited to redirect abuse with low integrity impact; there is no code execution, data disclosure, or availability impact. Vendor-released patch: 1.10.0. No public exploit identified at time of analysis.
Unauthenticated term-name enumeration in the Patreon WordPress plugin (versions below 1.10.0) lets remote attackers query taxonomy terms, including non-public and custom taxonomies that WordPress normally keeps off the front end. Successful exploitation leaks only the names of terms, not post content, credentials, or personally identifiable information, and no write access is gained, so the practical value depends on whether a site defines private or otherwise non-public taxonomies whose labels are themselves sensitive (for example internal customer segments or unpublished categorization schemes). The assessed vector (AV:N/AC:L/PR:N/UI:N, C:L) reflects a low-impact but easily reachable disclosure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 1.10.0 to address the missing authorization check.
Authenticated SQL injection in the BSK PDF Manager WordPress plugin through 3.8.1 allows users with contributor-level access or higher to inject malicious input into an unsanitised plugin parameter and read sensitive database contents, including administrator password hashes. Exploitation requires a valid low-privilege WordPress account; sites that do not allow untrusted registration or do not grant contributor access to outsiders have substantially reduced exposure. No public exploit was identified at time of analysis, and the impact described is confidentiality-only.
PHP object injection in ACF Frontend Admin by DynamiApps through 3.29.13 lets an authenticated administrator store crafted serialized content that the plugin later deserializes when rendering public-facing pages. Remote code execution is conditional: it requires a usable POP/gadget chain in the plugin or WordPress core, so object injection alone does not guarantee code execution; the CVSS 3.1 score is 6.6 with PR:H and AC:H. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated visitors can overwrite site-wide ACF option values on WordPress sites running ACF Frontend Admin by DynamiApps through 3.29.13 when a publicly exposed form reaches one of the plugin's form-submission actions. The missing capability check means no login, privileges, or user interaction are required where such a form is published, but exposure is deployment-dependent because the vulnerable action must be reachable from a front-end form. The provided data contains no CISA KEV entry or public exploit code; impact is assessed as integrity-only at CVSS 5.3 Medium.
Unauthenticated account creation in the WP User Manager WordPress plugin versions 2.9.x before 2.9.20 allows remote attackers to obtain functional WordPress accounts without completing payment when the site uses payment-gated registration. The plugin creates the WordPress user before payment confirmation and does not roll it back if the payment step fails, leaving an integrity-only impact (CVSS 5.3, C:N/I:L/A:N). Exploitation is configuration-dependent because only sites with payment-gated registration enabled are exposed; no public exploit identified at time of analysis.
WP Data Access plugin versions before 5.5.88 expose an action that lacks both an authorization capability check and a CSRF nonce, allowing any authenticated user, including a self-registered subscriber, to make the WordPress server connect to arbitrary hosts and ports, including internal network endpoints, and read back the connection result. This is a medium-severity server-side request forgery issue (CVSS 5.0, CWE-918) with a changed scope because the attacker can pivot requests from the public site into internal services, though confidentiality impact is limited to the returned connection outcome. No public exploit identified at time of analysis; exploitation requires an account on the target site, which is trivial where open registration is enabled but infeasible where registration is disabled and no attacker-controlled account exists.
Path traversal in the Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2) lets an unauthenticated attacker attach arbitrary files to a form's outgoing email by supplying a crafted signature field value that is used unsanitized to build the attachment path. The read is bounded to the wp-content directory, and disclosure only occurs when the affected form is configured to send a copy of the submission to a submitter-controlled address, so default single-recipient (site-admin-only) forms are not exploitable for exfiltration; this deployment dependency is why CVSS rates attack complexity High (5.9, AV:N/AC:H/PR:N/UI:N/C:H/I:N/A:N). No public exploit code has been identified at time of analysis.
SQL injection in the Ukr-To-Lat WordPress plugin, affecting all versions through 1.3.5, allows authenticated users holding Contributor-level access or higher to inject arbitrary SQL through an unsanitized term name and thereby read sensitive data from the site's database. The assessed impact is confidentiality-only (high), with no integrity or availability effect, and exploitation requires a valid low-privileged account - a realistic path on sites with open registration or weak account hygiene. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so this is a moderate-priority rather than top-priority issue.
Unauthenticated retrieval of WooCommerce order secret keys in the PeachPay payments plugin (versions 1.117.9 up to but not including 1.120.70) lets remote attackers read customer name, email, postal address, and order contents for any paid order. The plugin returns an order's secret key without performing capability or ownership checks, so anyone who can reach the store and reference a valid paid order can harvest the key and use it to view that order's PII. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 1.120.70 to correct the missing authorization check.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Cross-site request forgery in the WordPress plugin User Registration & Membership through 5.2.8 lets unauthenticated attackers trick a logged-in administrator into approving pending registrations or denying arbitrary user accounts, potentially locking targeted users out of the site. Exploitation requires the administrator to click a crafted link or visit a malicious page (UI:R) and depends on an empty new_role parameter that bypasses the plugin's nonce check and WordPress core's bulk-user nonce validation. Impact is limited to unauthorized registration-status changes (low integrity, no confidentiality or availability impact); no public exploit identified at time of analysis.
WP Booking System - Booking Calendar through 2.1.0.3 allows an authenticated user with pre-existing per-form edit delegation to overwrite user_permission meta and grant edit access to all booking forms, including to arbitrary other users. The issue is a missing-authorization flaw (CWE-862) rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); the key precondition is that an administrator must already have delegated edit rights on at least one form, which exposes the edit page and a reusable wpbs_edit_form nonce. No public exploit has been identified at time of analysis, and impact is confined to the plugin’s booking-form ACL and data rather than site-wide takeover.
Low-privilege information disclosure in the WP Booking System - Booking Calendar WordPress plugin through version 2.1.0.3, where the calendar AJAX handler fails to enforce a capability check on the 'id' parameter. Any authenticated user at subscriber level or above (PR:L, network-reachable, no user interaction) can pull private per-event booking descriptions and booking IDs from calendars they do not own. Assessed CVSS 6.5 reflects high confidentiality impact with no integrity or availability effect; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the practical risk is bounded by the need for a valid subscriber account - sites that disable open registration and have no untrusted low-privilege users are largely insulated.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Welcart e-Commerce versions through 2.12.4 allow authenticated users with editor-level privileges or higher to inject SQL through the searchSql and searchSkuSql JSON fields in the wp_usces_order_old request, enabling read-only disclosure of sensitive database contents. The flaw is an authenticated order-management SQL injection (CWE-89) with high confidentiality impact but no integrity or availability impact. No public exploit identified at time of analysis, and the elevated account requirement keeps overall risk moderate.
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Authenticated administrator-level users of the WordPress plugin Post Export Import with Media through 1.17.2 can read files outside the intended export directory through the theme_slug parameter when the peiwm_enable_admin_download_buttons setting is enabled. The issue is a CWE-22 directory traversal rated CVSS 4.9 with confidentiality-only impact, and exploitation is gated by both administrator authentication and a non-default feature toggle. No public exploit was identified at time of analysis, and the admin-only prerequisite makes this a low-priority edge-case risk rather than a broadly exploitable path traversal.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) lets an unauthenticated attacker execute arbitrary script in a victim's browser by luring them to a crafted URL that supplies a malicious 'token_id' query parameter to the plugin's REST endpoint. The path segment is filtered to word characters, but WP_REST_Request's query-string precedence lets '?token_id=' override the path value and reach the handler unsanitized, so the regex protection is effectively void on default installs. Successful exploitation requires user interaction (UI:R, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1), and impact is limited to reflected script execution in the context of the targeted site; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.5) allows any authenticated user with subscriber-level access to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The root cause is a missing capability check (CWE-862) on the plugin's rewrite-rule management action, reachable remotely with low attack complexity and no user interaction. Impact is limited to the plugin's own cache rules rather than arbitrary file content, and no public exploit code or confirmed active exploitation was identified at time of analysis; overall priority is low (CVSS 4.3).
Missing authorization in the 10up Distributor WordPress plugin before 2.3.2 allows authenticated users with Contributor-level privileges to invoke AJAX handlers that were intended only for administrators, enabling them to send stored external-connection credentials to an attacker-controlled server via dt_verify_external_connection or to create new external connections via dt_begin_authorization. Exploitation requires a valid low-privilege login (CVSS vector PR:L, so authenticated, not anonymous), and the credential-theft path only works on sites that already have a configured external connection holding stored credentials; sites without pre-existing connections or without untrusted Contributor-level accounts have no exposed attack surface. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 2.3.2.
PHP object injection in 10up Distributor before 2.3.2 allows an authenticated Contributor-level user on a connected source WordPress site to store a serialized-PHP-shaped string as post meta, which the destination site's set_meta() function in includes/utils.php then unserializes a second time, instantiating attacker-influenced objects on the receiving site. Real-world impact is heavily gated: exploitation requires a configured Distributor push/pull relationship between two sites and a usable PHP gadget (POP) chain in the destination's loaded plugins or themes, otherwise object instantiation accomplishes little. Tracked as CWE-502 with a CVSS 4.0 base score of 2.3 (independent assessment: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and no public exploit identified at time of analysis, this is a low-priority hardening issue rather than an urgent, actively exploited flaw.
Authenticated Contributor-level users on a WordPress multisite network running 10up Distributor before 2.3.2 can create draft or published posts on network sites they do not have access to by invoking the dt-push AJAX action with a chosen connection ID and postStatus. The flaw is a moderate-severity missing authorization condition in ajax_push() (CWE-862) and is limited to multisite installations; single-site WordPress installs are not exploitable, and super admins are out of scope. Vendor-released patch: 2.3.2; no public exploit identified at time of analysis.
Stored cross-site scripting in the Tourfic WordPress plugin (versions up to and including 3.0.1) allows attackers with subscriber-level or WooCommerce customer credentials to inject malicious JavaScript into comment content, which executes when victims view affected pages, REST API responses, or RSS feeds. Because WooCommerce customer registration is open without admin approval, any visitor can effectively become an attacker; the payload bypasses the plugin's own wp_kses_post() sanitization when served via the unauthenticated GET /wp-json/wp/v2/comments endpoint (content.rendered) and comment RSS feeds. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauthenticated remote attackers to bypass the plugin's gated-content access controls and read content that the site owner intended to restrict. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no authentication, no user interaction, and no non-default configuration, but the impact is confined to low-level confidentiality loss - no data modification, code execution, or site takeover. There is no public exploit identified at time of analysis, and the flaw only matters on sites that actively use Passster's protection feature to gate content; sites that do not gate content with the plugin are unaffected.
Stored cross-site scripting in the WordPress plugin PowerPack Addons for Elementor (slug powerpack-lite-for-elementor) through version 3.1.0 lets an authenticated attacker with contributor- or editor-level access inject malicious script through the plugin's Elementor widgets, which then executes in the browser of any user who later views the affected page. CVSS 3.1 scores this 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a low-privileged but authenticated requirement plus user interaction from the victim viewer, so exploitation is not fully automatic. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the practical risk is a moderate, deliverable-but-conditional stored XSS rather than an emergency.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.
Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.
Authorization bypass in SmartCrawl (smartcrawl-seo) through version 3.16.4 allows an authenticated low-privilege user to manipulate a user-controlled key and access or modify data they should not be able to access, due to CWE-639 insecure direct object reference and incorrect access control configuration. This is a moderate-severity issue (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) whose real-world risk is constrained by the requirement for a valid low-privilege account; no public exploit identified at time of analysis, and no KEV or EPSS signal was provided. Sites running affected SmartCrawl versions should monitor the Patchstack advisory and update beyond 3.16.4 once a fixed release is confirmed.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Stored cross-site scripting in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 allows an authenticated low-privilege user to persist JavaScript that later executes in the browser of any higher-privileged user who views the affected map content. The issue is scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires a pre-existing authenticated account with enough rights to submit or edit MapSVG input, and that the payload only fires when a victim - typically an administrator or editor - renders the page; no public exploit identified at time of analysis and there is no CISA KEV listing. Deployment risk is concentrated on sites that grant content-entry or map-editing roles to untrusted or semi-trusted users, since anonymous visitors cannot trigger the stored payload.
Information disclosure in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 lets unauthenticated remote attackers retrieve sensitive data that a site has embedded in its MapSVG maps and content, because a missing authorization check (CWE-862) fails to properly gate access to that stored data. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are needed and only network reachability to the affected site is required, while impact is confined to confidentiality with no integrity or availability effect and no public exploit identified at time of analysis. Practical risk therefore depends on what operators have placed inside MapSVG content: sites storing only public map data face negligible real impact, whereas those that embedded secrets or private records in map fields should treat this as a live exposure.
Missing authorization in the Squeeze WordPress plugin before 1.8.1 lets any authenticated user with a role as low as Subscriber revert arbitrary media attachments to their stored backup copies and then permanently delete both those backups and the plugin-generated WebP derivatives, regardless of attachment ownership. The flaw is remotely reachable with low privileges (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N, producing only low integrity and availability impact with no confidentiality impact), and publicly available exploit code exists via a WPScan exploit reference; there is no KEV entry or other confirmation of active exploitation. Practical exposure is confined to sites that permit open registration or otherwise allow untrusted users to hold at least a Subscriber account.
Unauthenticated information disclosure in the MAIO WordPress plugin before version 7.3.22 allows any remote attacker to retrieve the plugin's stored crawl-analytics log - including each recorded visitor's IP address, user agent, and referer - by presenting a credential value that ships verbatim in the plugin's own publicly distributed source as a valid API key. Because the accepted key is readable by anyone who downloads the plugin, there is effectively no authentication barrier: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and no non-default configuration is required beyond the analytics logging being in use so that records exist. Publicly available exploit code exists via the WPScan advisory; the impact is confined to telemetry disclosure with no integrity or availability effect, giving a moderate CVSS score of 5.3.
Stored cross-site scripting in the Events Made Easy WordPress plugin (all versions up to and including 3.2.22) lets unauthenticated attackers inject arbitrary script into the event[location_name] field, which then executes in the browser of any visitor who views the affected location map balloon. Per the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) the flaw is remotely reachable without credentials, but exploiting it requires an administrator to have explicitly enabled both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) - both of which default to off - so default-configured sites are not exposed. There is no public exploit identified at time of analysis and the plugin is not in CISA KEV; the vendor addressed the issue in version 3.2.23.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.191) allows authenticated attackers with subscriber-level access or above to inject arbitrary JavaScript into a listing's post_content that then executes in the browser of any visitor viewing that listing page. The attacker must own an already-published listing, because the GeoDir_Post_Data::can_edit() ownership check limits who can store the payload and ajax_save_post() re-applies the existing post_status on edit, so changes to a published listing bypass re-moderation and go live immediately; sites that disable open registration, disallow front-end submissions, or hold listings in moderation are substantially less exposed. This moderate-severity flaw (CVSS 6.4, CWE-79) was reported by Wordfence, and no public exploit identified at time of analysis (it is not listed in CISA KEV).
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress Name Directory plugin (all versions up to and including 1.34.2) allows authenticated attackers holding contributor-level privileges or higher to inject arbitrary JavaScript via the 'dir' attribute of the plugin's shortcode, which is then persisted and executed in the browser of any user who later views the affected page. The issue is a plugin-specific input sanitization and output escaping failure (CWE-79) rather than a WordPress core privilege escalation, and it is remediated in version 1.34.3. No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting moderate severity with low confidentiality and integrity impact and scope change from the plugin context into the victim's browsing session.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
Stored cross-site scripting in the SureDash - Community, Courses & Member Dashboard WordPress plugin affects all versions up to and including 1.12.0 and lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through the 'display_name' parameter, which is stored and later rendered as live HTML. The payload fires when any user hovers over a comment's like counter on a community page, because the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description value directly to innerHTML and the browser re-parses the decoded entity payload as markup. This is a moderate-risk authenticated stored XSS (CVSS 6.4, CWE-79) rather than an urgent emergency; exploitation requires a registered account, an active SureDash community/comment interface, and a victim performing the hover interaction, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. An EPSS score was not included in the available intelligence, and the vendor has released version 1.12.1 which removes the condition.
Stored cross-site scripting in the MaxFoundry Social Share Buttons plugin for WordPress, affecting all versions up to and including 1.30, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary JavaScript through the 'form' parameter containing 'share_url', which then executes in the browser of any user who views the injected page. Exploitation is gated by the plugin's review-nag logic: the nonce required to reach the vulnerable save-network handler is only rendered in the DOM after a 7-day timer has elapsed since the attacker's first wp-admin visit, so a low-privilege account and a multi-day wait are both required, which is why the assessed vector raises attack complexity to High and this is treated as a moderate-priority issue rather than an emergency. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the FiboSearch - Ajax Search for WooCommerce WordPress plugin, in all versions up to and including 1.34.2, lets an authenticated attacker with Subscriber-level access or above inject arbitrary JavaScript through the 'purchased_plan' parameter that later executes in the browser of any user viewing the affected admin page. Exploitation is gated by a non-default precondition: the site owner must have already completed the standard Freemius opt-in flow, after which a Subscriber can trigger the vulnerable handler simply by loading /wp-admin/profile.php with crafted query parameters. Scored CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the issue is confirmed fixed in 1.34.3; no public exploit code has been identified at time of analysis, and it is not listed as actively exploited.
Missing authorization in the Gemini Labs Site Reviews WordPress plugin (versions through 8.3.4) allows unauthenticated remote attackers to perform actions that should require elevated privileges, because affected endpoints do not correctly enforce access-control checks. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), exploitation needs no authentication or user interaction against a default install, but impact is limited to low-integrity tampering with plugin-controlled data - no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is constrained to sites that both run the vulnerable plugin version and expose the affected functionality to the network.
Authenticated attackers holding only subscriber-level access can execute arbitrary WordPress shortcodes on sites running the WPEverest User Registration & Membership plugin in all versions up to and including 5.2.8, because an action passes an unvalidated value straight into do_shortcode without checking it first. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and there is no public exploit identified at time of analysis - it is not confirmed actively exploited (CISA KEV). Impact is bounded, but the practical risk is elevated on the many sites that leave open user registration enabled, since an attacker can simply self-provision the required subscriber account and then trigger the vulnerable shortcode path; sites that disable open registration meaningfully reduce exposure.
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (etruel) affects all versions up to and including 2.9 and allows an unauthenticated remote attacker to plant arbitrary web scripts inside imported posts. The attacker does not need a WordPress account: because the plugin strips WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() whenever a campaign's last editor holds the unfiltered_html capability - a flag the plugin sets automatically for every admin-saved campaign - raw RSS markup taken from $item->get_content() is written verbatim into post_content. Exploitation therefore depends on an administrator having subscribed a campaign to an RSS feed the attacker publishes or compromises, and the injected script only fires when a visitor later opens the imported post; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, 5.4) reflects that attacker-controlled precondition.
Authenticated WordPress users holding Contributor-level access or higher can publish, unpublish, or bulk-delete any map created with the Wp Map Block plugin, including maps owned by administrators, because the plugin's Maps_Controller REST endpoints through version 3.0.0 rely on a permission callback that only checks edit_posts and never validates object ownership or publish-level capability. Successful abuse either hides published maps from every public page site-wide or forces draft maps to become publicly visible, and the bulk branch additionally deletes wpmb_map posts outright. Impact is confined to the integrity of map post status with no code execution path; no public exploit code was identified at time of analysis, and this is a medium-severity broken-access-control issue (CVSS 4.3) rather than a critical compromise.
Authenticated users with Subscriber-level access or above can read the titles, URLs, authors, categories, tags, and 40-word excerpts of every unpublished draft, pending, or scheduled post on WordPress sites running the WSP MCP AI Agents Connector plugin through version 2.9.5. The wsp_get_posts MCP tool is registered with an empty capability requirement, the MCP endpoint's authenticate() method accepts any logged-in user, and the tool's callback honors a caller-supplied status=all argument that expands the underlying WP_Query without an author or ownership filter. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor-assigned CVSS of 6.5 is higher than this assessment's estimate (4.3, C:L) because disclosure is bounded to post metadata and short excerpts rather than full post content.
Unauthenticated privilege escalation in the WP Compress - Instant Performance & Speed Optimization plugin for WordPress (all versions up to and including 7.25.00) allows remote attackers with no WordPress account to gain plugin-administrator-equivalent control over the plugin's optimization, CDN and critical-CSS settings. The chain is two-stage: the stored plugin API key is first leaked by the unauthenticated `wpc_send_critical_remote` nopriv AJAX action, but only when the external critical-CSS service returns an `apiResults` field that causes `initCritical()` to echo the key via `wp_send_json_success`; the harvested key is then replayed as the `apikey` parameter to the `start_comms` dispatcher, which performs no capability check and no nonce verification before passing attacker-controlled `group`, `setting` and `value` parameters into `change_setting()`, writing them into the `WPS_IC_SETTINGS` option without an allow-list and causing `checkAndAddCaps()` to grant the `manage_wpc_settings` capability to arbitrary roles, including Subscriber. The assessed severity is moderate - CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) - unauthenticated per the vector (PR:N) but rated high complexity because the API-key disclosure depends on the external critical-CSS service response; impact is scoped to the plugin's settings surfaces rather than full WordPress site administration, and no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows an authenticated attacker with subscriber-level access or above to inject arbitrary web scripts through the 'message' parameter, which are then rendered to other users. Exploitation is conditional: the site administrator must have enabled user listing submission (a non-default setting), and a victim must subsequently log in through the login form embedded on the attacker's listing page for the payload to execute in their browser. This is a medium-severity issue (CVSS 6.4, CWE-79); no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so it should be treated as a moderate, conditional priority rather than an emergency.
Stored cross-site scripting (XSS) in the WebberZone Top 10 - Popular Posts WordPress plugin, a moderate-severity issue (CVSS 6.4), affects all versions up to and including 4.5.2 and allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts via crafted block JSON. The attacker sets an undeclared is_widget flag to '1' and supplies a malicious instance_id value that is concatenated into an unescaped HTML class attribute, so the payload executes when a victim-potentially an administrator-views the injected page. No public exploit code has been identified at the time of analysis, and exploitation requires a WordPress site that permits contributor-level or higher accounts and a non-default block configuration.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.192) allows an authenticated user with Subscriber-level access to inject arbitrary JavaScript into the 'twitterusername' custom field, which is then stored and executed whenever another user - ideally a higher-privileged admin or moderator - views the affected listing page. The only input restriction on that field is a client-side HTML 'pattern' attribute, which is trivially bypassed, while server-side sanitization and output escaping are insufficient. Exploitation is confirmed to require an account with listing-creation privileges and a victim who views the injected listing; no public exploit code has been identified at time of analysis, and the overall risk is assessed as moderate priority.
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin, affecting all versions up to and including 7.2.8, allows an authenticated attacker with subscriber-level access or above to inject arbitrary script into an order 'note' that executes when a privileged user opens the affected order-notes page in wp-admin. The payload defeats WordPress' sanitize_textarea_field() filtering because it is saved as a hex-escaped sequence such as \x3cimg onerror=...\x3e that is only reconstituted into a live HTML tag by stripcslashes() during admin-side rendering, after sanitization has already run. No public exploit code has been identified at time of analysis, and exploitation is conditional on the victim (typically an administrator) viewing the poisoned notes view, so the practical risk is moderate rather than critical; the vendor has committed an upstream code fix in the plugin's order-notes view.
Authenticated SQL injection in the WP Booking System - Booking Calendar plugin for WordPress (all versions up to and including 2.1.0.1) lets a user with Administrator-level privileges or above inject arbitrary SQL via the AJAX 'data[orderby]' parameter and read sensitive records from the site database. The attack path is constrained: the orderby value only reaches the SQL query builder when the booking AJAX handler takes the use_ajax branch, which requires the targeted calendar to contain more than 200 bookings - a non-default state that an Administrator can deliberately create. This issue is not listed in CISA KEV and no public exploit code was identified at time of analysis; a confidentiality-only impact (CVSS 4.9, PR:H, no user interaction) keeps the practical risk low-to-moderate, and the vendor has released 2.1.0.2 to fix it.
Sensitive information exposure in HUSKY - Products Filter for WooCommerce Professional through 1.4.5 allows unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on public frontend filter pages when the Statistics extension, saved external MySQL credentials, and Turbo Mode are all enabled. This is a moderate, conditional risk: default or internal-database configurations are not affected, and no public exploit was identified at time of analysis, but any site that has adopted those documented settings should treat the credentials as potentially exposed.
Information disclosure in the Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 allows an authenticated user with only Contributor-level access to read other customers' order details via the plugin's calendar-view AJAX actions, which are missing a capability check. Publicly available exploit code exists per WPScan, but EPSS is a low 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Practical exposure is limited to WooCommerce stores that grant Contributor-or-higher accounts to untrusted or semi-trusted users, since a valid low-privilege login on the target site is required.
Authenticated SQL injection in the affiliate-toolkit WordPress plugin before version 3.8.9 allows editor-level users to read arbitrary database contents. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and no active exploitation has been confirmed (not in CISA KEV). The independent assessment rates this as a genuine but moderate-priority issue, not an emergency; on WordPress multisite, a sub-site editor can extract the network-global wp_users table, including the super administrator's password hash, while on single-site installs the attacker needs a valid editor+ account.
Improper authorization in the Smush WordPress plugin before 4.3.4 lets an administrator of a single subsite on a WordPress multisite network change a network-wide access setting that should be modifiable only by a network super-administrator. Only multisite deployments running Smush versions earlier than 4.3.4 are exposed, and the attacker must already hold the administrator role on at least one subsite (PR:H, per the supplied vector), so the issue is not reachable by unauthenticated or low-privilege users. Impact is limited to modification of a configuration value - no data disclosure or service disruption - and public exploit code exists, though EPSS is only 0.14% (3rd percentile) and there is no evidence of active exploitation; the vendor has released a fix in Smush 4.3.4.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Authentication bypass in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated attackers to compute valid booking-API tokens for staff or administrator accounts, gaining access to the booking API as those users. The tokens are generated from a hardcoded value and the one-second issuance timestamp instead of a secure random source, so an attacker who can constrain that timestamp can forge a token. Publicly available exploit code exists, but EPSS is only 0.14% and the issue is not in CISA KEV, consistent with the high complexity (AC:H) of bounding the issuance window; the vendor has released version 10.31.9 to fix it.
The Salon Booking System WordPress plugin before 10.31.3 fails to enforce capability checks on several of its booking REST API routes, so any authenticated user - including a low-privilege subscriber - can retrieve the booking records and personal data of every customer on the site. The vulnerability is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) but requires a valid account, meaning sites that allow self-service registration or that host untrusted low-privilege users are the realistic attack surface. Publicly available exploit code exists via the WPScan disclosure, though EPSS is low (0.15%, 4th percentile) and no active exploitation has been confirmed. This is a genuine but moderate-priority information disclosure issue rather than a top-tier emergency.
Missing authorization and CSRF protections in the MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 allow any authenticated user - including a low-privileged subscriber - to trigger the plugin's one-way migration routine, which creates unwanted published records and permanently deletes the site's entire post-type and taxonomy configuration. The migration actions perform neither a capability check nor nonce validation (CWE-862 broken access control), so no administrator role or valid token is required; an independent assessment rates the availability impact as High because the configuration loss is irreversible. Publicly available exploit code exists (publicly available exploit code exists), but EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation; the primary practical prerequisite is that the target site accepts self-service/low-privilege registration.
The Visual Form Builder WordPress plugin through version 3.1 renders a wp-admin dashboard widget that lists recent form submissions without performing any capability or authorization check, so any authenticated user at Subscriber level or above can read other users' submitted contact information - names, email addresses, form titles and timestamps. Exploitation requires a valid low-privilege WordPress account (CVSS PR:L) and the ability to reach the dashboard where the widget loads, and the impact is confined to read-only disclosure with no data modification or account takeover. Publicly available exploit code exists, but there is no confirmed active exploitation, no CISA KEV listing, and the EPSS score is negligible at 0.15% (4th percentile), so this is a genuinely low-priority issue that is nonetheless a real and easily fixed flaw.
Authenticated users with Subscriber-level access can persistently corrupt the field structure of any form built with Visual Form Builder through 3.1, because the plugin's field-reordering action performs neither an authorization nor a nonce check (CWE-862). Publicly available exploit code exists, but EPSS is just 0.14% (3rd percentile) and CISA KEV does not list this issue, so active exploitation is not confirmed. The impact is limited to integrity-forms break for public visitors-with no data disclosure, and exposure is greatest on sites that permit open user registration.
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.
Unauthenticated information disclosure in the Document Gallery WordPress plugin through 5.1.1 lets any remote visitor generate a gallery on demand and read back the titles, descriptions, and direct file URLs of media attached to unpublished, private, or trashed posts. Because the on-demand gallery path performs no capability or ownership check, the issue is reachable on default installations with no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); publicly available exploit code exists, so scanning and opportunistic abuse are plausible, although no confirmed active exploitation (CISA KEV) has been recorded and EPSS puts likelihood low at roughly 0.14% (3rd percentile). Impact is bounded: the leak is confidentiality-only and data-dependent - sites that keep no sensitive media attached to drafts, private, or trashed content expose little of consequence, which is why our independent assessment rates this as a genuine but moderate-severity flaw rather than a critical priority.
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).
WordPress sites running the Subscribe to Comments plugin before 2.3.3 expose subscriber management keys to unauthenticated attackers, who can supply a forged or replayed commenter-identifying cookie that the plugin neither signs nor validates, then read a subscriber's management key and silently alter that subscriber's comment-thread subscriptions. Exploitation requires only that a subscriber exists on the target site and that the vulnerable plugin version is active; no authentication (PR:N) or user interaction (UI:N) is needed, and impact is scoped per targeted subscriber rather than site-wide (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, EPSS is 0.14% (3rd percentile), and no confirmed active exploitation has been reported.
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Blind SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 3.6.1, lets an authenticated attacker with vendor-level access or higher inject arbitrary SQL through the src_by[].val.start and src_by[].val.end parameters when the 'bt' (BETWEEN) operator is used, allowing extraction of sensitive data from the WordPress database. The defect is an incomplete fix for a SQL injection patched in 3.6.0, which hardened only the gt/lt/le/ge operator branches and left the BETWEEN branch unescaped. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis; this is a moderate-priority issue rather than an emergency, since exploitation requires a privileged vendor account and the blind nature of the injection makes data extraction slower and noisier.
Arbitrary shortcode execution in the Slim SEO WordPress plugin (all versions up to and including 4.11.1) allows an authenticated attacker holding a Subscriber-level account to store a shortcode payload in their own Biographical Info field, which the plugin subsequently passes to do_shortcode when rendering that author's description on the front end. Exploitation is gated by concrete prerequisites - an attacker-controlled low-privilege account (in practice, open user registration), a front-end request that resolves the author description without redirection (the ?author= query parameter while Slim SEO's auto_redirection setting is disabled), and the presence of other plugins whose shortcodes are worth invoking - and the resulting impact depends on which shortcodes other installed plugins expose, making this a moderate, authentication-gated code-injection issue rather than a top-priority emergency. No public exploit identified at time of analysis, and the vendor shipped a fix in 4.11.2 that strips shortcodes from the user bio.
Sensitive information exposure in the WordPress plugin Lightweight Cookie Notice (daext) in all versions up to and including 1.19 leaks the W3TC_DYNAMIC_SECURITY constant, which the plugin hardcodes to a publicly known value; a remote, unauthenticated attacker can therefore learn the W3 Total Cache mfunc security key without any credentials or user interaction. On sites that also run W3 Total Cache with its mfunc dynamic-content feature active, knowledge of that key may allow an attacker to forge signed mfunc directives and inject arbitrary PHP code, but the confidentiality leak alone scores only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and escalation to code execution is strictly conditional on the co-presence and configuration of that second plugin. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
Authenticated file disclosure in the Tainacan WordPress plugin (all versions up to and including 1.3.0) allows any logged-in user with subscriber-level access or above to read the contents of arbitrary files on the web server, including sensitive files such as wp-config.php. The flaw is conditional and only exploitable when the uploads/tainacan directory does not exist on the target server; on any installation where Tainacan has previously run and created that directory, the path-containment check holds and the attack fails. Impact is limited to read-only information disclosure (no write or code execution), no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the assessed severity is moderate given the authentication requirement and the narrow environmental prerequisite.
Stored cross-site scripting in the Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin affects all versions up to and including 3.0.1, allowing an authenticated attacker with contributor-level access or above to inject arbitrary web scripts via the 'type' parameter handled by the Wishlist shortcode. The injected payload is crafted without angle-bracket characters so it survives the wp_kses_post filter applied on save, and it then executes as a live event handler in the unauthenticated (guest) rendering branch whenever any visitor loads the affected page. Rated medium severity (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit code or CISA KEV entry was identified at time of analysis, and the practical risk is bounded by the requirement that a site grant the attacker contributor rights (for example through open registration or lax role assignment) and publish the injected content to guest-visible pages.
Stored cross-site scripting in the WordPress Profile Builder plugin (CozmoLabs) affects all versions up to and including 4.0.3 and allows an authenticated subscriber-level user to inject persistent JavaScript that executes in the browsers of anyone viewing an affected page. The payload is written through the 'display_name' parameter and, critically, is stored in wp_comments.comment_author, so it survives deleting or renaming the attacker's account and continues to fire as long as the poisoned comment is rendered. Exploitation requires the target site to allow self-service registration or the attacker to already hold a low-privilege account; no public exploit identified at time of analysis, and the plugin's own vendor-reported severity is moderate (CVSS 6.4, PR:L, scope-changed).
Stored cross-site scripting in the Quick PayPal Payments: Payment Button & Form WordPress plugin (all versions up to and including 6.0.4) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript through the plugin's 'form' parameter, which then executes for every viewer of the affected post. The sanitization bypass is notable because the payload survives wp_kses_post by using a quote-breaking, angle-bracket-free construction, so injected script fires even for Editors and Administrators who routinely preview a Contributor's pending content. No public exploit code has been identified at time of analysis, and this is a moderate-severity (CVSS 6.4) issue whose practical exposure depends on whether a site permits untrusted users to register or be assigned the Contributor role.
Stored cross-site scripting in the SQL Chart Builder plugin for WordPress (elvinhaci), affecting all versions from 0 through 3.0.6, allows an authenticated subscriber-level user to persist arbitrary JavaScript that executes for anyone viewing a rendered chart. The attacker seeds a payload into a user-controlled database column - for example display_name set via /wp-admin/profile.php - and the plugin later prints that value unescaped as a chart X-axis label, so execution depends on an administrator having published a chart whose SQL query projects such a column and on a victim subsequently loading that page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a moderate-risk, not a top-priority, issue whose real-world reach is limited by that required admin-created chart configuration.
Reflected cross-site scripting in the Gwolle Guestbook WordPress plugin (all versions up to and including 5.1.1) allows unauthenticated attackers to inject arbitrary script into pages generated by the plugin's permalink handling, executing in the browser of any victim lured into clicking a crafted link. Tracked as CWE-79 and rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw requires no authentication but is gated on victim interaction, which keeps it a medium-severity, per-victim attack requiring individual luring. No public exploit code was identified at the time of analysis, and the impact is confined to the victim's browser session (script execution in the site's origin context) rather than granting server-side access.
Authorization bypass in the LPagery (Bulk Page Generator) plugin for WordPress, affecting all versions up to and including 3.1.0, allows any authenticated user with subscriber-level privileges or above to create, modify, and delete LPagery-managed pages and bulk page-generation jobs that should be restricted to administrators. The plugin fails to enforce authorization checks (CWE-862) on its LPagery REST/OAuth endpoints, and on default fresh installations where the Freemius integration has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making those tokens forgeable by any authenticated user. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity-impact flaw gated behind an authenticated account.
Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.
Stored DOM-based cross-site scripting in the YMC Smart Filter plugin for WordPress (all versions through 3.12.19) allows a user with Author-level access or higher to plant script inside a post title that is later rendered unsafely by the plugin's front-end search widget, executing in the browser of anyone who views the injected page or types into the filter search box. The autocomplete REST search endpoint registers a permission callback that unconditionally returns true, so triggering the payload requires no authentication whatsoever, while only Author-level capability is needed to store it; this mismatch is reflected in the CVSS scope change (S:C) and the PR:L rating. Impact is limited to client-side script execution in the visitor's session (C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the primary exposure limiter is whether a site hands Author accounts to untrusted users.
Unauthenticated information disclosure and click-statistics manipulation in the ThirstyAffiliates WordPress plugin before 3.12.1 lets remote attackers query the plugin's link redirect tracking handler to reveal destination URLs of unpublished affiliate links and to record fabricated clicks. The issue affects WordPress sites running the plugin with its redirect/click-tracking handler reachable, requires no credentials or user interaction, and is fixed in vendor release 3.12.1; no public exploit was identified at time of analysis.
CSRF in the Patreon WordPress plugin before 1.10.0 allows remote attackers to re-link a WordPress site's Patreon integration to an attacker-controlled Patreon account by tricking a logged-in administrator into loading a crafted request, because the account-connect action does not verify a nonce. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N): exploitation needs a victim administrator with an active session and the plugin's Patreon connect feature in use, but no attacker authentication. Impact is limited to integrity - takeover of the site's Patreon integration, with no direct code execution or data disclosure reported; no public exploit was identified at time of analysis, and a vendor fix is available in 1.10.0.
Open redirect in the Patreon WordPress plugin before 1.10.0 allows unauthenticated attackers to craft links that send visitors to arbitrary external sites after they click, enabling phishing that abuses the trusted WordPress site's domain. Exploitation requires user interaction (UI:R) and is limited to redirect abuse with low integrity impact; there is no code execution, data disclosure, or availability impact. Vendor-released patch: 1.10.0. No public exploit identified at time of analysis.
Unauthenticated term-name enumeration in the Patreon WordPress plugin (versions below 1.10.0) lets remote attackers query taxonomy terms, including non-public and custom taxonomies that WordPress normally keeps off the front end. Successful exploitation leaks only the names of terms, not post content, credentials, or personally identifiable information, and no write access is gained, so the practical value depends on whether a site defines private or otherwise non-public taxonomies whose labels are themselves sensitive (for example internal customer segments or unpublished categorization schemes). The assessed vector (AV:N/AC:L/PR:N/UI:N, C:L) reflects a low-impact but easily reachable disclosure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 1.10.0 to address the missing authorization check.
Authenticated SQL injection in the BSK PDF Manager WordPress plugin through 3.8.1 allows users with contributor-level access or higher to inject malicious input into an unsanitised plugin parameter and read sensitive database contents, including administrator password hashes. Exploitation requires a valid low-privilege WordPress account; sites that do not allow untrusted registration or do not grant contributor access to outsiders have substantially reduced exposure. No public exploit was identified at time of analysis, and the impact described is confidentiality-only.
PHP object injection in ACF Frontend Admin by DynamiApps through 3.29.13 lets an authenticated administrator store crafted serialized content that the plugin later deserializes when rendering public-facing pages. Remote code execution is conditional: it requires a usable POP/gadget chain in the plugin or WordPress core, so object injection alone does not guarantee code execution; the CVSS 3.1 score is 6.6 with PR:H and AC:H. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated visitors can overwrite site-wide ACF option values on WordPress sites running ACF Frontend Admin by DynamiApps through 3.29.13 when a publicly exposed form reaches one of the plugin's form-submission actions. The missing capability check means no login, privileges, or user interaction are required where such a form is published, but exposure is deployment-dependent because the vulnerable action must be reachable from a front-end form. The provided data contains no CISA KEV entry or public exploit code; impact is assessed as integrity-only at CVSS 5.3 Medium.
Unauthenticated account creation in the WP User Manager WordPress plugin versions 2.9.x before 2.9.20 allows remote attackers to obtain functional WordPress accounts without completing payment when the site uses payment-gated registration. The plugin creates the WordPress user before payment confirmation and does not roll it back if the payment step fails, leaving an integrity-only impact (CVSS 5.3, C:N/I:L/A:N). Exploitation is configuration-dependent because only sites with payment-gated registration enabled are exposed; no public exploit identified at time of analysis.
WP Data Access plugin versions before 5.5.88 expose an action that lacks both an authorization capability check and a CSRF nonce, allowing any authenticated user, including a self-registered subscriber, to make the WordPress server connect to arbitrary hosts and ports, including internal network endpoints, and read back the connection result. This is a medium-severity server-side request forgery issue (CVSS 5.0, CWE-918) with a changed scope because the attacker can pivot requests from the public site into internal services, though confidentiality impact is limited to the returned connection outcome. No public exploit identified at time of analysis; exploitation requires an account on the target site, which is trivial where open registration is enabled but infeasible where registration is disabled and no attacker-controlled account exists.
Path traversal in the Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2) lets an unauthenticated attacker attach arbitrary files to a form's outgoing email by supplying a crafted signature field value that is used unsanitized to build the attachment path. The read is bounded to the wp-content directory, and disclosure only occurs when the affected form is configured to send a copy of the submission to a submitter-controlled address, so default single-recipient (site-admin-only) forms are not exploitable for exfiltration; this deployment dependency is why CVSS rates attack complexity High (5.9, AV:N/AC:H/PR:N/UI:N/C:H/I:N/A:N). No public exploit code has been identified at time of analysis.
SQL injection in the Ukr-To-Lat WordPress plugin, affecting all versions through 1.3.5, allows authenticated users holding Contributor-level access or higher to inject arbitrary SQL through an unsanitized term name and thereby read sensitive data from the site's database. The assessed impact is confidentiality-only (high), with no integrity or availability effect, and exploitation requires a valid low-privileged account - a realistic path on sites with open registration or weak account hygiene. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so this is a moderate-priority rather than top-priority issue.
Unauthenticated retrieval of WooCommerce order secret keys in the PeachPay payments plugin (versions 1.117.9 up to but not including 1.120.70) lets remote attackers read customer name, email, postal address, and order contents for any paid order. The plugin returns an order's secret key without performing capability or ownership checks, so anyone who can reach the store and reference a valid paid order can harvest the key and use it to view that order's PII. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released version 1.120.70 to correct the missing authorization check.
Stored cross-site scripting in the Themify Popup plugin for WordPress (all versions up to and including 1.4.7) allows an authenticated user holding author-level privileges or higher to persist arbitrary script into the site's popup configuration via the 'popup_width_unit' parameter, which is then executed in the browser of any visitor or administrator who loads the injected page. Because the payload is stored rather than reflected, a single low-privilege write can compromise every subsequent page view, and the CVSS:3.1 scope-change rating (S:C) reflects that the injected script runs in the broader site context rather than an isolated component. Exploitation is gated by the author-level account prerequisite and requires no interaction from the victim (UI:N); there is no public exploit code or CISA KEV entry identified at time of analysis, and EPSS data was not supplied, so the practical risk is concentrated on multi-author sites that grant author or higher roles to untrusted or self-registered users.
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
Stored cross-site scripting in the Themify Builder plugin for WordPress (all versions through 7.8.2) allows an authenticated attacker holding a contributor-level account or above to inject arbitrary JavaScript through the 'visible' attribute of the slider shortcode, which is then persisted and executed in the browser of any user who views the injected page. The payload survives in post content because the attribute is neither sanitized on input nor escaped on output, and it is only reachable when the 'slider' custom post type is registered - normally satisfied automatically by a Themify theme or any other plugin that registers that CPT. Exploitation is not anonymous (CVSS PR:L) and requires a victim to load the poisoned page; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and the issue rates as a moderate-priority stored-XSS rather than an emergency.
Cross-site request forgery in the WordPress plugin User Registration & Membership through 5.2.8 lets unauthenticated attackers trick a logged-in administrator into approving pending registrations or denying arbitrary user accounts, potentially locking targeted users out of the site. Exploitation requires the administrator to click a crafted link or visit a malicious page (UI:R) and depends on an empty new_role parameter that bypasses the plugin's nonce check and WordPress core's bulk-user nonce validation. Impact is limited to unauthorized registration-status changes (low integrity, no confidentiality or availability impact); no public exploit identified at time of analysis.
WP Booking System - Booking Calendar through 2.1.0.3 allows an authenticated user with pre-existing per-form edit delegation to overwrite user_permission meta and grant edit access to all booking forms, including to arbitrary other users. The issue is a missing-authorization flaw (CWE-862) rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); the key precondition is that an administrator must already have delegated edit rights on at least one form, which exposes the edit page and a reusable wpbs_edit_form nonce. No public exploit has been identified at time of analysis, and impact is confined to the plugin’s booking-form ACL and data rather than site-wide takeover.
Low-privilege information disclosure in the WP Booking System - Booking Calendar WordPress plugin through version 2.1.0.3, where the calendar AJAX handler fails to enforce a capability check on the 'id' parameter. Any authenticated user at subscriber level or above (PR:L, network-reachable, no user interaction) can pull private per-event booking descriptions and booking IDs from calendars they do not own. Assessed CVSS 6.5 reflects high confidentiality impact with no integrity or availability effect; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the practical risk is bounded by the need for a valid subscriber account - sites that disable open registration and have no untrusted low-privilege users are largely insulated.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Welcart e-Commerce versions through 2.12.4 allow authenticated users with editor-level privileges or higher to inject SQL through the searchSql and searchSkuSql JSON fields in the wp_usces_order_old request, enabling read-only disclosure of sensitive database contents. The flaw is an authenticated order-management SQL injection (CWE-89) with high confidentiality impact but no integrity or availability impact. No public exploit identified at time of analysis, and the elevated account requirement keeps overall risk moderate.
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Authenticated administrator-level users of the WordPress plugin Post Export Import with Media through 1.17.2 can read files outside the intended export directory through the theme_slug parameter when the peiwm_enable_admin_download_buttons setting is enabled. The issue is a CWE-22 directory traversal rated CVSS 4.9 with confidentiality-only impact, and exploitation is gated by both administrator authentication and a non-default feature toggle. No public exploit was identified at time of analysis, and the admin-only prerequisite makes this a low-priority edge-case risk rather than a broadly exploitable path traversal.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Reflected cross-site scripting in the Hippoo Mobile App for WooCommerce WordPress plugin (all versions through 1.12.0) lets an unauthenticated attacker execute arbitrary script in a victim's browser by luring them to a crafted URL that supplies a malicious 'token_id' query parameter to the plugin's REST endpoint. The path segment is filtered to word characters, but WP_REST_Request's query-string precedence lets '?token_id=' override the path value and reach the handler unsanitized, so the regex protection is effectively void on default installs. Successful exploitation requires user interaction (UI:R, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1), and impact is limited to reflected script execution in the context of the targeted site; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.5) allows any authenticated user with subscriber-level access to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The root cause is a missing capability check (CWE-862) on the plugin's rewrite-rule management action, reachable remotely with low attack complexity and no user interaction. Impact is limited to the plugin's own cache rules rather than arbitrary file content, and no public exploit code or confirmed active exploitation was identified at time of analysis; overall priority is low (CVSS 4.3).
Missing authorization in the 10up Distributor WordPress plugin before 2.3.2 allows authenticated users with Contributor-level privileges to invoke AJAX handlers that were intended only for administrators, enabling them to send stored external-connection credentials to an attacker-controlled server via dt_verify_external_connection or to create new external connections via dt_begin_authorization. Exploitation requires a valid low-privilege login (CVSS vector PR:L, so authenticated, not anonymous), and the credential-theft path only works on sites that already have a configured external connection holding stored credentials; sites without pre-existing connections or without untrusted Contributor-level accounts have no exposed attack surface. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 2.3.2.
PHP object injection in 10up Distributor before 2.3.2 allows an authenticated Contributor-level user on a connected source WordPress site to store a serialized-PHP-shaped string as post meta, which the destination site's set_meta() function in includes/utils.php then unserializes a second time, instantiating attacker-influenced objects on the receiving site. Real-world impact is heavily gated: exploitation requires a configured Distributor push/pull relationship between two sites and a usable PHP gadget (POP) chain in the destination's loaded plugins or themes, otherwise object instantiation accomplishes little. Tracked as CWE-502 with a CVSS 4.0 base score of 2.3 (independent assessment: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and no public exploit identified at time of analysis, this is a low-priority hardening issue rather than an urgent, actively exploited flaw.
Authenticated Contributor-level users on a WordPress multisite network running 10up Distributor before 2.3.2 can create draft or published posts on network sites they do not have access to by invoking the dt-push AJAX action with a chosen connection ID and postStatus. The flaw is a moderate-severity missing authorization condition in ajax_push() (CWE-862) and is limited to multisite installations; single-site WordPress installs are not exploitable, and super admins are out of scope. Vendor-released patch: 2.3.2; no public exploit identified at time of analysis.
Stored cross-site scripting in the Tourfic WordPress plugin (versions up to and including 3.0.1) allows attackers with subscriber-level or WooCommerce customer credentials to inject malicious JavaScript into comment content, which executes when victims view affected pages, REST API responses, or RSS feeds. Because WooCommerce customer registration is open without admin approval, any visitor can effectively become an attacker; the payload bypasses the plugin's own wp_kses_post() sanitization when served via the unauthenticated GET /wp-json/wp/v2/comments endpoint (content.rendered) and comment RSS feeds. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauthenticated remote attackers to bypass the plugin's gated-content access controls and read content that the site owner intended to restrict. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no authentication, no user interaction, and no non-default configuration, but the impact is confined to low-level confidentiality loss - no data modification, code execution, or site takeover. There is no public exploit identified at time of analysis, and the flaw only matters on sites that actively use Passster's protection feature to gate content; sites that do not gate content with the plugin are unaffected.
Stored cross-site scripting in the WordPress plugin PowerPack Addons for Elementor (slug powerpack-lite-for-elementor) through version 3.1.0 lets an authenticated attacker with contributor- or editor-level access inject malicious script through the plugin's Elementor widgets, which then executes in the browser of any user who later views the affected page. CVSS 3.1 scores this 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a low-privileged but authenticated requirement plus user interaction from the victim viewer, so exploitation is not fully automatic. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the practical risk is a moderate, deliverable-but-conditional stored XSS rather than an emergency.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
Stored cross-site scripting in the WordPress plugin The Events Calendar (versions through 6.18.1) lets an authenticated attacker with event-authoring privileges inject persistent JavaScript that executes when another user, such as an administrator, views the affected event page. Exploitation requires a low-privilege WordPress account (PR:L) and victim interaction (UI:R), and the flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit has been identified at time of analysis, and the issue was reported by Patchstack.
Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.
Authorization bypass in SmartCrawl (smartcrawl-seo) through version 3.16.4 allows an authenticated low-privilege user to manipulate a user-controlled key and access or modify data they should not be able to access, due to CWE-639 insecure direct object reference and incorrect access control configuration. This is a moderate-severity issue (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) whose real-world risk is constrained by the requirement for a valid low-privilege account; no public exploit identified at time of analysis, and no KEV or EPSS signal was provided. Sites running affected SmartCrawl versions should monitor the Patchstack advisory and update beyond 3.16.4 once a fixed release is confirmed.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Stored cross-site scripting in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 allows an authenticated low-privilege user to persist JavaScript that later executes in the browser of any higher-privileged user who views the affected map content. The issue is scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation requires a pre-existing authenticated account with enough rights to submit or edit MapSVG input, and that the payload only fires when a victim - typically an administrator or editor - renders the page; no public exploit identified at time of analysis and there is no CISA KEV listing. Deployment risk is concentrated on sites that grant content-entry or map-editing roles to untrusted or semi-trusted users, since anonymous visitors cannot trigger the stored payload.
Information disclosure in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 lets unauthenticated remote attackers retrieve sensitive data that a site has embedded in its MapSVG maps and content, because a missing authorization check (CWE-862) fails to properly gate access to that stored data. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are needed and only network reachability to the affected site is required, while impact is confined to confidentiality with no integrity or availability effect and no public exploit identified at time of analysis. Practical risk therefore depends on what operators have placed inside MapSVG content: sites storing only public map data face negligible real impact, whereas those that embedded secrets or private records in map fields should treat this as a live exposure.
Missing authorization in the Squeeze WordPress plugin before 1.8.1 lets any authenticated user with a role as low as Subscriber revert arbitrary media attachments to their stored backup copies and then permanently delete both those backups and the plugin-generated WebP derivatives, regardless of attachment ownership. The flaw is remotely reachable with low privileges (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N, producing only low integrity and availability impact with no confidentiality impact), and publicly available exploit code exists via a WPScan exploit reference; there is no KEV entry or other confirmation of active exploitation. Practical exposure is confined to sites that permit open registration or otherwise allow untrusted users to hold at least a Subscriber account.
Unauthenticated information disclosure in the MAIO WordPress plugin before version 7.3.22 allows any remote attacker to retrieve the plugin's stored crawl-analytics log - including each recorded visitor's IP address, user agent, and referer - by presenting a credential value that ships verbatim in the plugin's own publicly distributed source as a valid API key. Because the accepted key is readable by anyone who downloads the plugin, there is effectively no authentication barrier: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and no non-default configuration is required beyond the analytics logging being in use so that records exist. Publicly available exploit code exists via the WPScan advisory; the impact is confined to telemetry disclosure with no integrity or availability effect, giving a moderate CVSS score of 5.3.
Stored cross-site scripting in the Events Made Easy WordPress plugin (all versions up to and including 3.2.22) lets unauthenticated attackers inject arbitrary script into the event[location_name] field, which then executes in the browser of any visitor who views the affected location map balloon. Per the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) the flaw is remotely reachable without credentials, but exploiting it requires an administrator to have explicitly enabled both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) - both of which default to off - so default-configured sites are not exposed. There is no public exploit identified at time of analysis and the plugin is not in CISA KEV; the vendor addressed the issue in version 3.2.23.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.191) allows authenticated attackers with subscriber-level access or above to inject arbitrary JavaScript into a listing's post_content that then executes in the browser of any visitor viewing that listing page. The attacker must own an already-published listing, because the GeoDir_Post_Data::can_edit() ownership check limits who can store the payload and ajax_save_post() re-applies the existing post_status on edit, so changes to a published listing bypass re-moderation and go live immediately; sites that disable open registration, disallow front-end submissions, or hold listings in moderation are substantially less exposed. This moderate-severity flaw (CVSS 6.4, CWE-79) was reported by Wordfence, and no public exploit identified at time of analysis (it is not listed in CISA KEV).
Arbitrary shortcode execution in the ProfilePress (formerly WP User Avatar) WordPress plugin through version 4.17.5 allows authenticated users with Subscriber-level access or higher to plant shortcode markup inside a comment, which is later rendered server-side by do_shortcode() when any visitor opens that user's front-end profile Comments tab. Because the plugin's ppress_neutralize_buffer_shortcodes() pass only strips pp-custom-html and bracket fragments containing HTML delimiters, shortcodes exposed by any other active plugin or theme remain intact and can be executed with attacker-chosen attributes, giving a low-privilege user a route to capability-gated or data-returning shortcodes and to raw HTML injection on a publicly viewable page. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the impact is bounded by which shortcodes a given site happens to have installed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress Name Directory plugin (all versions up to and including 1.34.2) allows authenticated attackers holding contributor-level privileges or higher to inject arbitrary JavaScript via the 'dir' attribute of the plugin's shortcode, which is then persisted and executed in the browser of any user who later views the affected page. The issue is a plugin-specific input sanitization and output escaping failure (CWE-79) rather than a WordPress core privilege escalation, and it is remediated in version 1.34.3. No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting moderate severity with low confidentiality and integrity impact and scope change from the plugin context into the victim's browsing session.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
Stored cross-site scripting in the SureDash - Community, Courses & Member Dashboard WordPress plugin affects all versions up to and including 1.12.0 and lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through the 'display_name' parameter, which is stored and later rendered as live HTML. The payload fires when any user hovers over a comment's like counter on a community page, because the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description value directly to innerHTML and the browser re-parses the decoded entity payload as markup. This is a moderate-risk authenticated stored XSS (CVSS 6.4, CWE-79) rather than an urgent emergency; exploitation requires a registered account, an active SureDash community/comment interface, and a victim performing the hover interaction, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. An EPSS score was not included in the available intelligence, and the vendor has released version 1.12.1 which removes the condition.
Stored cross-site scripting in the MaxFoundry Social Share Buttons plugin for WordPress, affecting all versions up to and including 1.30, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary JavaScript through the 'form' parameter containing 'share_url', which then executes in the browser of any user who views the injected page. Exploitation is gated by the plugin's review-nag logic: the nonce required to reach the vulnerable save-network handler is only rendered in the DOM after a 7-day timer has elapsed since the attacker's first wp-admin visit, so a low-privilege account and a multi-day wait are both required, which is why the assessed vector raises attack complexity to High and this is treated as a moderate-priority issue rather than an emergency. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the FiboSearch - Ajax Search for WooCommerce WordPress plugin, in all versions up to and including 1.34.2, lets an authenticated attacker with Subscriber-level access or above inject arbitrary JavaScript through the 'purchased_plan' parameter that later executes in the browser of any user viewing the affected admin page. Exploitation is gated by a non-default precondition: the site owner must have already completed the standard Freemius opt-in flow, after which a Subscriber can trigger the vulnerable handler simply by loading /wp-admin/profile.php with crafted query parameters. Scored CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the issue is confirmed fixed in 1.34.3; no public exploit code has been identified at time of analysis, and it is not listed as actively exploited.
Missing authorization in the Gemini Labs Site Reviews WordPress plugin (versions through 8.3.4) allows unauthenticated remote attackers to perform actions that should require elevated privileges, because affected endpoints do not correctly enforce access-control checks. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), exploitation needs no authentication or user interaction against a default install, but impact is limited to low-integrity tampering with plugin-controlled data - no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is constrained to sites that both run the vulnerable plugin version and expose the affected functionality to the network.
Authenticated attackers holding only subscriber-level access can execute arbitrary WordPress shortcodes on sites running the WPEverest User Registration & Membership plugin in all versions up to and including 5.2.8, because an action passes an unvalidated value straight into do_shortcode without checking it first. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and there is no public exploit identified at time of analysis - it is not confirmed actively exploited (CISA KEV). Impact is bounded, but the practical risk is elevated on the many sites that leave open user registration enabled, since an attacker can simply self-provision the required subscriber account and then trigger the vulnerable shortcode path; sites that disable open registration meaningfully reduce exposure.
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (etruel) affects all versions up to and including 2.9 and allows an unauthenticated remote attacker to plant arbitrary web scripts inside imported posts. The attacker does not need a WordPress account: because the plugin strips WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() whenever a campaign's last editor holds the unfiltered_html capability - a flag the plugin sets automatically for every admin-saved campaign - raw RSS markup taken from $item->get_content() is written verbatim into post_content. Exploitation therefore depends on an administrator having subscribed a campaign to an RSS feed the attacker publishes or compromises, and the injected script only fires when a visitor later opens the imported post; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, 5.4) reflects that attacker-controlled precondition.
Authenticated WordPress users holding Contributor-level access or higher can publish, unpublish, or bulk-delete any map created with the Wp Map Block plugin, including maps owned by administrators, because the plugin's Maps_Controller REST endpoints through version 3.0.0 rely on a permission callback that only checks edit_posts and never validates object ownership or publish-level capability. Successful abuse either hides published maps from every public page site-wide or forces draft maps to become publicly visible, and the bulk branch additionally deletes wpmb_map posts outright. Impact is confined to the integrity of map post status with no code execution path; no public exploit code was identified at time of analysis, and this is a medium-severity broken-access-control issue (CVSS 4.3) rather than a critical compromise.
Authenticated users with Subscriber-level access or above can read the titles, URLs, authors, categories, tags, and 40-word excerpts of every unpublished draft, pending, or scheduled post on WordPress sites running the WSP MCP AI Agents Connector plugin through version 2.9.5. The wsp_get_posts MCP tool is registered with an empty capability requirement, the MCP endpoint's authenticate() method accepts any logged-in user, and the tool's callback honors a caller-supplied status=all argument that expands the underlying WP_Query without an author or ownership filter. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor-assigned CVSS of 6.5 is higher than this assessment's estimate (4.3, C:L) because disclosure is bounded to post metadata and short excerpts rather than full post content.
Unauthenticated privilege escalation in the WP Compress - Instant Performance & Speed Optimization plugin for WordPress (all versions up to and including 7.25.00) allows remote attackers with no WordPress account to gain plugin-administrator-equivalent control over the plugin's optimization, CDN and critical-CSS settings. The chain is two-stage: the stored plugin API key is first leaked by the unauthenticated `wpc_send_critical_remote` nopriv AJAX action, but only when the external critical-CSS service returns an `apiResults` field that causes `initCritical()` to echo the key via `wp_send_json_success`; the harvested key is then replayed as the `apikey` parameter to the `start_comms` dispatcher, which performs no capability check and no nonce verification before passing attacker-controlled `group`, `setting` and `value` parameters into `change_setting()`, writing them into the `WPS_IC_SETTINGS` option without an allow-list and causing `checkAndAddCaps()` to grant the `manage_wpc_settings` capability to arbitrary roles, including Subscriber. The assessed severity is moderate - CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) - unauthenticated per the vector (PR:N) but rated high complexity because the API-key disclosure depends on the external critical-CSS service response; impact is scoped to the plugin's settings surfaces rather than full WordPress site administration, and no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows an authenticated attacker with subscriber-level access or above to inject arbitrary web scripts through the 'message' parameter, which are then rendered to other users. Exploitation is conditional: the site administrator must have enabled user listing submission (a non-default setting), and a victim must subsequently log in through the login form embedded on the attacker's listing page for the payload to execute in their browser. This is a medium-severity issue (CVSS 6.4, CWE-79); no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so it should be treated as a moderate, conditional priority rather than an emergency.
Stored cross-site scripting (XSS) in the WebberZone Top 10 - Popular Posts WordPress plugin, a moderate-severity issue (CVSS 6.4), affects all versions up to and including 4.5.2 and allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts via crafted block JSON. The attacker sets an undeclared is_widget flag to '1' and supplies a malicious instance_id value that is concatenated into an unescaped HTML class attribute, so the payload executes when a victim-potentially an administrator-views the injected page. No public exploit code has been identified at the time of analysis, and exploitation requires a WordPress site that permits contributor-level or higher accounts and a non-default block configuration.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.192) allows an authenticated user with Subscriber-level access to inject arbitrary JavaScript into the 'twitterusername' custom field, which is then stored and executed whenever another user - ideally a higher-privileged admin or moderator - views the affected listing page. The only input restriction on that field is a client-side HTML 'pattern' attribute, which is trivially bypassed, while server-side sanitization and output escaping are insufficient. Exploitation is confirmed to require an account with listing-creation privileges and a victim who views the injected listing; no public exploit code has been identified at time of analysis, and the overall risk is assessed as moderate priority.
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin, affecting all versions up to and including 7.2.8, allows an authenticated attacker with subscriber-level access or above to inject arbitrary script into an order 'note' that executes when a privileged user opens the affected order-notes page in wp-admin. The payload defeats WordPress' sanitize_textarea_field() filtering because it is saved as a hex-escaped sequence such as \x3cimg onerror=...\x3e that is only reconstituted into a live HTML tag by stripcslashes() during admin-side rendering, after sanitization has already run. No public exploit code has been identified at time of analysis, and exploitation is conditional on the victim (typically an administrator) viewing the poisoned notes view, so the practical risk is moderate rather than critical; the vendor has committed an upstream code fix in the plugin's order-notes view.
Authenticated SQL injection in the WP Booking System - Booking Calendar plugin for WordPress (all versions up to and including 2.1.0.1) lets a user with Administrator-level privileges or above inject arbitrary SQL via the AJAX 'data[orderby]' parameter and read sensitive records from the site database. The attack path is constrained: the orderby value only reaches the SQL query builder when the booking AJAX handler takes the use_ajax branch, which requires the targeted calendar to contain more than 200 bookings - a non-default state that an Administrator can deliberately create. This issue is not listed in CISA KEV and no public exploit code was identified at time of analysis; a confidentiality-only impact (CVSS 4.9, PR:H, no user interaction) keeps the practical risk low-to-moderate, and the vendor has released 2.1.0.2 to fix it.
Sensitive information exposure in HUSKY - Products Filter for WooCommerce Professional through 1.4.5 allows unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on public frontend filter pages when the Statistics extension, saved external MySQL credentials, and Turbo Mode are all enabled. This is a moderate, conditional risk: default or internal-database configurations are not affected, and no public exploit was identified at time of analysis, but any site that has adopted those documented settings should treat the credentials as potentially exposed.
Information disclosure in the Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 allows an authenticated user with only Contributor-level access to read other customers' order details via the plugin's calendar-view AJAX actions, which are missing a capability check. Publicly available exploit code exists per WPScan, but EPSS is a low 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Practical exposure is limited to WooCommerce stores that grant Contributor-or-higher accounts to untrusted or semi-trusted users, since a valid low-privilege login on the target site is required.
Authenticated SQL injection in the affiliate-toolkit WordPress plugin before version 3.8.9 allows editor-level users to read arbitrary database contents. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and no active exploitation has been confirmed (not in CISA KEV). The independent assessment rates this as a genuine but moderate-priority issue, not an emergency; on WordPress multisite, a sub-site editor can extract the network-global wp_users table, including the super administrator's password hash, while on single-site installs the attacker needs a valid editor+ account.
Improper authorization in the Smush WordPress plugin before 4.3.4 lets an administrator of a single subsite on a WordPress multisite network change a network-wide access setting that should be modifiable only by a network super-administrator. Only multisite deployments running Smush versions earlier than 4.3.4 are exposed, and the attacker must already hold the administrator role on at least one subsite (PR:H, per the supplied vector), so the issue is not reachable by unauthenticated or low-privilege users. Impact is limited to modification of a configuration value - no data disclosure or service disruption - and public exploit code exists, though EPSS is only 0.14% (3rd percentile) and there is no evidence of active exploitation; the vendor has released a fix in Smush 4.3.4.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Authentication bypass in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated attackers to compute valid booking-API tokens for staff or administrator accounts, gaining access to the booking API as those users. The tokens are generated from a hardcoded value and the one-second issuance timestamp instead of a secure random source, so an attacker who can constrain that timestamp can forge a token. Publicly available exploit code exists, but EPSS is only 0.14% and the issue is not in CISA KEV, consistent with the high complexity (AC:H) of bounding the issuance window; the vendor has released version 10.31.9 to fix it.
The Salon Booking System WordPress plugin before 10.31.3 fails to enforce capability checks on several of its booking REST API routes, so any authenticated user - including a low-privilege subscriber - can retrieve the booking records and personal data of every customer on the site. The vulnerability is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) but requires a valid account, meaning sites that allow self-service registration or that host untrusted low-privilege users are the realistic attack surface. Publicly available exploit code exists via the WPScan disclosure, though EPSS is low (0.15%, 4th percentile) and no active exploitation has been confirmed. This is a genuine but moderate-priority information disclosure issue rather than a top-tier emergency.
Missing authorization and CSRF protections in the MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 allow any authenticated user - including a low-privileged subscriber - to trigger the plugin's one-way migration routine, which creates unwanted published records and permanently deletes the site's entire post-type and taxonomy configuration. The migration actions perform neither a capability check nor nonce validation (CWE-862 broken access control), so no administrator role or valid token is required; an independent assessment rates the availability impact as High because the configuration loss is irreversible. Publicly available exploit code exists (publicly available exploit code exists), but EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation; the primary practical prerequisite is that the target site accepts self-service/low-privilege registration.
The Visual Form Builder WordPress plugin through version 3.1 renders a wp-admin dashboard widget that lists recent form submissions without performing any capability or authorization check, so any authenticated user at Subscriber level or above can read other users' submitted contact information - names, email addresses, form titles and timestamps. Exploitation requires a valid low-privilege WordPress account (CVSS PR:L) and the ability to reach the dashboard where the widget loads, and the impact is confined to read-only disclosure with no data modification or account takeover. Publicly available exploit code exists, but there is no confirmed active exploitation, no CISA KEV listing, and the EPSS score is negligible at 0.15% (4th percentile), so this is a genuinely low-priority issue that is nonetheless a real and easily fixed flaw.
Authenticated users with Subscriber-level access can persistently corrupt the field structure of any form built with Visual Form Builder through 3.1, because the plugin's field-reordering action performs neither an authorization nor a nonce check (CWE-862). Publicly available exploit code exists, but EPSS is just 0.14% (3rd percentile) and CISA KEV does not list this issue, so active exploitation is not confirmed. The impact is limited to integrity-forms break for public visitors-with no data disclosure, and exposure is greatest on sites that permit open user registration.
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.
Unauthenticated information disclosure in the Document Gallery WordPress plugin through 5.1.1 lets any remote visitor generate a gallery on demand and read back the titles, descriptions, and direct file URLs of media attached to unpublished, private, or trashed posts. Because the on-demand gallery path performs no capability or ownership check, the issue is reachable on default installations with no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); publicly available exploit code exists, so scanning and opportunistic abuse are plausible, although no confirmed active exploitation (CISA KEV) has been recorded and EPSS puts likelihood low at roughly 0.14% (3rd percentile). Impact is bounded: the leak is confidentiality-only and data-dependent - sites that keep no sensitive media attached to drafts, private, or trashed content expose little of consequence, which is why our independent assessment rates this as a genuine but moderate-severity flaw rather than a critical priority.
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).
WordPress sites running the Subscribe to Comments plugin before 2.3.3 expose subscriber management keys to unauthenticated attackers, who can supply a forged or replayed commenter-identifying cookie that the plugin neither signs nor validates, then read a subscriber's management key and silently alter that subscriber's comment-thread subscriptions. Exploitation requires only that a subscriber exists on the target site and that the vulnerable plugin version is active; no authentication (PR:N) or user interaction (UI:N) is needed, and impact is scoped per targeted subscriber rather than site-wide (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, EPSS is 0.14% (3rd percentile), and no confirmed active exploitation has been reported.
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Blind SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 3.6.1, lets an authenticated attacker with vendor-level access or higher inject arbitrary SQL through the src_by[].val.start and src_by[].val.end parameters when the 'bt' (BETWEEN) operator is used, allowing extraction of sensitive data from the WordPress database. The defect is an incomplete fix for a SQL injection patched in 3.6.0, which hardened only the gt/lt/le/ge operator branches and left the BETWEEN branch unescaped. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis; this is a moderate-priority issue rather than an emergency, since exploitation requires a privileged vendor account and the blind nature of the injection makes data extraction slower and noisier.
Arbitrary shortcode execution in the Slim SEO WordPress plugin (all versions up to and including 4.11.1) allows an authenticated attacker holding a Subscriber-level account to store a shortcode payload in their own Biographical Info field, which the plugin subsequently passes to do_shortcode when rendering that author's description on the front end. Exploitation is gated by concrete prerequisites - an attacker-controlled low-privilege account (in practice, open user registration), a front-end request that resolves the author description without redirection (the ?author= query parameter while Slim SEO's auto_redirection setting is disabled), and the presence of other plugins whose shortcodes are worth invoking - and the resulting impact depends on which shortcodes other installed plugins expose, making this a moderate, authentication-gated code-injection issue rather than a top-priority emergency. No public exploit identified at time of analysis, and the vendor shipped a fix in 4.11.2 that strips shortcodes from the user bio.
Sensitive information exposure in the WordPress plugin Lightweight Cookie Notice (daext) in all versions up to and including 1.19 leaks the W3TC_DYNAMIC_SECURITY constant, which the plugin hardcodes to a publicly known value; a remote, unauthenticated attacker can therefore learn the W3 Total Cache mfunc security key without any credentials or user interaction. On sites that also run W3 Total Cache with its mfunc dynamic-content feature active, knowledge of that key may allow an attacker to forge signed mfunc directives and inject arbitrary PHP code, but the confidentiality leak alone scores only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and escalation to code execution is strictly conditional on the co-presence and configuration of that second plugin. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing).
Authenticated file disclosure in the Tainacan WordPress plugin (all versions up to and including 1.3.0) allows any logged-in user with subscriber-level access or above to read the contents of arbitrary files on the web server, including sensitive files such as wp-config.php. The flaw is conditional and only exploitable when the uploads/tainacan directory does not exist on the target server; on any installation where Tainacan has previously run and created that directory, the path-containment check holds and the attack fails. Impact is limited to read-only information disclosure (no write or code execution), no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the assessed severity is moderate given the authentication requirement and the narrow environmental prerequisite.
Stored cross-site scripting in the Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin affects all versions up to and including 3.0.1, allowing an authenticated attacker with contributor-level access or above to inject arbitrary web scripts via the 'type' parameter handled by the Wishlist shortcode. The injected payload is crafted without angle-bracket characters so it survives the wp_kses_post filter applied on save, and it then executes as a live event handler in the unauthenticated (guest) rendering branch whenever any visitor loads the affected page. Rated medium severity (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit code or CISA KEV entry was identified at time of analysis, and the practical risk is bounded by the requirement that a site grant the attacker contributor rights (for example through open registration or lax role assignment) and publish the injected content to guest-visible pages.
Stored cross-site scripting in the WordPress Profile Builder plugin (CozmoLabs) affects all versions up to and including 4.0.3 and allows an authenticated subscriber-level user to inject persistent JavaScript that executes in the browsers of anyone viewing an affected page. The payload is written through the 'display_name' parameter and, critically, is stored in wp_comments.comment_author, so it survives deleting or renaming the attacker's account and continues to fire as long as the poisoned comment is rendered. Exploitation requires the target site to allow self-service registration or the attacker to already hold a low-privilege account; no public exploit identified at time of analysis, and the plugin's own vendor-reported severity is moderate (CVSS 6.4, PR:L, scope-changed).
Stored cross-site scripting in the Quick PayPal Payments: Payment Button & Form WordPress plugin (all versions up to and including 6.0.4) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript through the plugin's 'form' parameter, which then executes for every viewer of the affected post. The sanitization bypass is notable because the payload survives wp_kses_post by using a quote-breaking, angle-bracket-free construction, so injected script fires even for Editors and Administrators who routinely preview a Contributor's pending content. No public exploit code has been identified at time of analysis, and this is a moderate-severity (CVSS 6.4) issue whose practical exposure depends on whether a site permits untrusted users to register or be assigned the Contributor role.
Stored cross-site scripting in the SQL Chart Builder plugin for WordPress (elvinhaci), affecting all versions from 0 through 3.0.6, allows an authenticated subscriber-level user to persist arbitrary JavaScript that executes for anyone viewing a rendered chart. The attacker seeds a payload into a user-controlled database column - for example display_name set via /wp-admin/profile.php - and the plugin later prints that value unescaped as a chart X-axis label, so execution depends on an administrator having published a chart whose SQL query projects such a column and on a victim subsequently loading that page. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a moderate-risk, not a top-priority, issue whose real-world reach is limited by that required admin-created chart configuration.
Reflected cross-site scripting in the Gwolle Guestbook WordPress plugin (all versions up to and including 5.1.1) allows unauthenticated attackers to inject arbitrary script into pages generated by the plugin's permalink handling, executing in the browser of any victim lured into clicking a crafted link. Tracked as CWE-79 and rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw requires no authentication but is gated on victim interaction, which keeps it a medium-severity, per-victim attack requiring individual luring. No public exploit code was identified at the time of analysis, and the impact is confined to the victim's browser session (script execution in the site's origin context) rather than granting server-side access.
Authorization bypass in the LPagery (Bulk Page Generator) plugin for WordPress, affecting all versions up to and including 3.1.0, allows any authenticated user with subscriber-level privileges or above to create, modify, and delete LPagery-managed pages and bulk page-generation jobs that should be restricted to administrators. The plugin fails to enforce authorization checks (CWE-862) on its LPagery REST/OAuth endpoints, and on default fresh installations where the Freemius integration has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making those tokens forgeable by any authenticated user. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity-impact flaw gated behind an authenticated account.
Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.