WordPress
Monthly
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.
SQL injection in the Mail Mint plugin for WordPress (versions up to and including 1.31.4) allows an authenticated attacker with the plugin-specific 'mint_read_contacts' capability to read sensitive database contents through the /wp-json/mrm/v1/segments/contacts REST endpoint. The issue is a genuine but moderate-priority SQL injection rather than a top-tier emergency because the capability is granted only to Administrators by default, although sites that have delegated it to lower-privileged roles via Mail Mint's role manager face greater risk. No public exploit identified at time of analysis; no KEV or EPSS data was provided.
Stored cross-site scripting in the Mang Board WordPress plugin (versions up to and including 2.4.4) allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts into pages via the 'content' parameter by omitting the data_type parameter in a modify request, which bypasses the HTMLPurifier sanitization branch and leaves only reversible mbw_htmlspecialchars2 encoding as a barrier. Exploitation requires only that a victim view the injected Mang Board page, resulting in in-browser script execution with limited confidentiality and integrity impact (CVSS 6.4); this is a moderate-severity issue representing a real but not emergency-level priority, and no public exploit identified at time of analysis. Sites that disable open registration meaningfully limit the attacker pool, and exploitation is specific to versions up to and including 2.4.4.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose.
Arbitrary shortcode execution in the WordPress Broken Link Checker plugin (all versions up to and including 2.4.14.1) allows an unauthenticated commenter to embed a shortcode payload in a comment's href or src attribute; once that comment is approved through the site's normal moderation workflow, the plugin's link parser passes the value to do_shortcode during a scheduled WP-Cron scan, executing the shortcode with no further attacker interaction. The published CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N), but the practical vector carries a user-interaction precondition (UI:R) because moderator approval is required, and impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis.
Authenticated vendor-level users of the Dokan multivendor marketplace plugin for WordPress (all versions up to and including 5.2.1) can reset the WordPress account password of any customer who has placed at least one order with their store, by supplying an arbitrary value to the 'password' parameter of the plugin's REST customers endpoint. The flaw is a CWE-639 insecure direct object reference: the endpoint's object-level guard only verifies that the target user is one of the requesting vendor's own customers, and never blocks changes to login-identity fields, so a vendor can overwrite the stored password hash and then log in as that customer for a limited account takeover. Vendor access required to exploit this can be self-obtained through the public 'I am a vendor' registration flow when that option is enabled, but the practical impact is bounded - the attacker must already hold a vendor or custom-level account and can only target customers with an existing order relationship; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Directory traversal in the WordPress plugin 'Debloat - Remove Unused CSS, Optimize JS' (all versions through 1.3.0) allows remote attackers to read arbitrary files on the server via crafted input in the 's' search parameter. According to our independent assessment, the CVSS vector is AV:N/AC:H/PR:N/UI:N (unauthenticated, no user interaction), so the trigger is a single crafted GET request to the public search endpoint - but only after a site administrator has enabled the plugin's 'Optimize CSS' feature with the default 'Inline Google Fonts' option active, which is why the attack is rated AC:H and conditional rather than universally exploitable. Impact is read-only confidentiality loss (C:H, I:N, A:N), typically exposing wp-config.php and other sensitive files subject to web-server/PHP file permissions; no public exploit code has been identified at time of analysis and there is no KEV listing, making this a moderate, conditionally-exploitable issue rather than a top-tier emergency.
Authenticated SQL injection in the FluentCart WordPress eCommerce plugin, affecting all versions up to and including 1.7.0, lets users who hold shop-management privileges slip attacker-chosen keys into an unprepared bulk-product-update query and read arbitrary data out of the site's database. The vulnerable path is the product bulk-update flow, and on FluentCart Pro installs the non-administrator 'Manager' shop role carries the products/edit permission and can therefore trigger it without administrator access - which is why the effective privilege requirement is moderate rather than high. Reported by Wordfence, this is a genuine but constrained issue rather than an urgent fire-drill: no public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is confined to confidentiality (database read/extraction) with no integrity or availability effect.
Stored cross-site scripting in the Cooked - Recipe Management plugin for WordPress (all versions up to and including 1.16.1) lets an authenticated attacker with contributor-level access or above embed arbitrary JavaScript through the [cooked-timer] shortcode, which is stored and then executed in the browser of any user - including an administrator - who later views the injected post, page, or recipe. The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handling (CWE-79), and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N places it at 6.4, a moderate-severity issue contingent on the attacker already holding a contributor+ account on a site running the vulnerable plugin. There is confirmed actively exploited status? No - no public exploit identified at time of analysis, and no CISA KEV listing; treat this as a routine patch-management priority rather than an emergency.
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.
Arbitrary shortcode execution in the Popup Box plugin for WordPress (ays-pro) versions 6.4.1 through 6.4.2 lets unauthenticated remote attackers invoke any shortcode registered on the site with attacker-chosen attributes, because client-controlled IP-related HTTP headers are folded into a popup body and then run through do_shortcode(). The attack is only reachable when a site administrator has manually inserted the %%user_ip_address%% token into a popup's Custom Content body, so default installations and sites that never use that token are not affected; impact is bounded by the shortcodes already installed (no direct PHP injection), which is why the assessed vector scores only 4.8 with high attack complexity. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor reference points to a fix in 6.4.3.
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Missing authorization in the WordPress plugin Login with Phone Number (all versions through 1.8.77) allows any authenticated user, including a low-privileged registered account, to perform a plugin action that should be reserved for a higher-privileged role. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (score 4.3), the attacker must already hold an account on the target site, the attack is network-reachable with no user interaction, and the impact is limited to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Missing authorization in the WebberZone Knowledge Base plugin for WordPress (versions through 3.2.0) allows unauthenticated remote attackers to reach knowledge base content that the plugin's access-control settings were intended to restrict. Because the CVSS vector is PR:N/UI:N, no account or victim interaction is needed; the exposure is limited to confidentiality (C:L, CVSS 5.3), with no write or availability impact. No public exploit code has been identified at time of analysis, and there is no confirmed CISA KEV entry, so real-world exploitation is not established from the available data.
Unauthenticated remote attackers can exploit missing authorization in the WP Desk Flexible Quantity (Measurement Price Calculator for WooCommerce) plugin, versions up to and including 2.3.23, to modify a constrained set of data with low integrity impact. The flaw, tracked as CWE-862 and rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), requires no authentication or user interaction, but the exact affected feature is unspecified. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Sunshine Photo Cart (WordPress plugin) versions up to 3.7.4 are affected by a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass access controls and read limited sensitive data from the plugin, such as cart or customer information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, but impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis.
Missing authorization in the WPdreams Ajax Search Lite WordPress plugin (versions through 4.14.5) allows unauthenticated remote attackers to read access-controlled data, resulting in low confidentiality impact. The vulnerability has a CVSS score of 5.3 and requires no authentication or user interaction; no public exploit identified at time of analysis. Site administrators should update the plugin as soon as a fixed version is available.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.
Missing authorization in the WPExperts WP EasyPay plugin (versions through 4.5.4) leaves a plugin-provided endpoint or action reachable by unauthenticated remote requests, so an attacker with network access to a WordPress site running the vulnerable plugin can invoke restricted functionality and read data they should not be able to reach. The reported CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning no credentials, no user interaction, and no non-default configuration are required, but the impact is confined to limited confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and no EPSS score was provided in the available intelligence, so exploitation risk currently rests on the ease of reaching the unauthenticated endpoint rather than on confirmed active abuse.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, lets an authenticated low-privilege user persist a malicious script through a plugin-controlled input field, which then executes in the browser of any privileged user who later views the affected page or admin screen. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation needs a valid low-privileged account plus a victim's page load, but that the resulting script runs with scope change into the surrounding admin context. No public exploit identified at time of analysis, and the flaw is a moderate rather than top-tier priority given the authentication and user-interaction gates.
Authenticated users with low-privileged WordPress accounts can exploit an insecure direct object reference (IDOR) in the Simply Schedule Appointments plugin through version 1.6.12.35 to read and alter appointment and booking records belonging to other users, because the plugin's endpoints accept a user-controlled object key without verifying ownership. The flaw requires valid credentials (CVSS vector PR:L, so it is not pre-auth) and yields only partial confidentiality and integrity impact rather than full site takeover; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate, authenticated-user authorization weakness rather than an emergency. Sites that grant subscriber-level or other low-privilege accounts are the primary exposure surface.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Missing authorization controls in the Meow Apps AI Engine WordPress plugin (all versions through 3.8.3) let an authenticated low-privileged user reach a plugin feature or endpoint whose access-control level is incorrectly configured, granting limited unauthorized modification (C:N/I:L/A:N) rather than data disclosure or service disruption. Exploitation requires a valid WordPress account with at least low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so unauthenticated visitors cannot trigger it, and only sites running the plugin at or below 3.8.3 are exposed. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuine but modest-priority broken-access-control issue reported through Patchstack.
Broken access control in the WordLift WordPress plugin (all versions through 3.54.15) lets an authenticated low-privilege user - a subscriber or contributor is sufficient - reach functionality that should be reserved for higher-privileged roles, yielding limited data disclosure and modification with a CVSS 3.1 score of 5.4 (C:L/I:L, no availability impact). Exploitation requires only a valid account on a site running the plugin, which makes open-registration, membership, and multi-author sites the most exposed; no user interaction is needed. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), so this is a moderate, not critical, priority - but it should be remediated promptly because the barrier to entry is a free account.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) allows an authenticated user with access to a plugin input field that persists data to store a malicious script which later executes in the browser of any other user viewing the affected page, including administrators. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires an authenticated low-privileged account plus subsequent victim interaction, and no public exploit code has been identified at time of analysis. Impact is bounded to the victim's browser session rather than direct server compromise, but the scope change (S:C) means the injected script can act with the victim's privileges against the surrounding application.
Code injection in the WPMU DEV Broken Link Checker WordPress plugin, affecting all versions up to and including 2.4.14.1, allows an unauthenticated remote attacker to feed crafted input to the plugin's link-checking/parsing routine and potentially expose sensitive data. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), exploitation is network-reachable and needs no privileges, but a victim must be induced to trigger the vulnerable action, and the confirmed impact is confined to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis.
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Authenticated Contributor-level users on WordPress sites running Blog2Social up to 9.1.4 can read arbitrary post titles and content, including private and pending posts owned by other users, through an insecure direct object reference in the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. The flaw is a low-severity information disclosure (CVSS 4.3, CWE-639) that requires a valid Contributor account; no public exploit identified at time of analysis and no confirmed active exploitation. It matters most on multi-author, membership, or guest-contributor sites where Contributor accounts are broadly assigned, because single-author installs expose little or no data beyond what the attacker can already see.
Sensitive information exposure in the Elementor Website Builder plugin for WordPress through version 4.2.3 lets any authenticated user with contributor-level access or higher read the full post_content and the plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors. Successful exploitation only requires a low-privileged account on the affected site and no victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), making open-registration, membership, and multi-author sites that hand out contributor roles the most exposed. This is a moderate, authorization-gap issue (CWE-862, Missing Authorization) rather than a high-urgency flaw; no public exploit was identified at the time of analysis.
Order status manipulation in Rede Itaú for WooCommerce before 5.5.3 allows unauthenticated remote attackers to change arbitrary WooCommerce order states - including marking unpaid orders as paid and cancelling completed orders - by forging payment gateway webhook requests. Publicly available exploit code exists, though the impact is limited to integrity (CVSS 5.3) and requires the plugin to be installed and its webhook endpoint reachable. No special configuration or user interaction is needed, but exposure is limited to merchants using the Itaú (Brazil) payment gateway.
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.
Unauthenticated attackers can forge payment notifications against WordPress/WooCommerce stores running the Cardinity Payment Gateway plugin before version 3.4.2, because the plugin ships with an empty notification signing secret and fails to properly validate the authenticity of incoming callbacks. By sending a crafted 'approved payment' (or 'failed') notification to the plugin's payment-callback handler, a remote attacker with no credentials and no user interaction can mark arbitrary orders as paid - payment fraud - or force legitimate orders into a failed state. The vulnerability is exploitable against default installations, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation in the wild; impact is bounded to order-status manipulation rather than code execution, data theft, or service disruption.
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.
Missing capability checks in the Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 allow any authenticated user - a Subscriber is sufficient per the CVSS vector (PR:L, authenticated) - to invoke plugin AJAX actions that read the URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs. Exploitation is conditional rather than opportunistic: the attacker needs a low-privileged account on the site, and an administrator must have already run the plugin's content scanner so that the harvested URL set exists, which is what drives the High attack complexity (AC:H) in the CVSS 4.2 score. Publicly available exploit code exists and the issue is fixed in version 2.0.2, but it is not listed in CISA KEV, and the exposure is meaningfully reduced on sites that disable open registration. This is a genuine but modest-priority issue, not a high-severity emergency.
Unauthenticated attackers can invoke several cancellation-related AJAX actions in the eaSYNC Booking WordPress plugin before 1.3.31 because those actions lack authorization and nonce validation, letting them create booking cancellation requests, fire booking notification emails, and overwrite the content of emails the site sends. Publicly available exploit code exists (the WPScan advisory is the exploit reference), but there is no indication of confirmed active exploitation in CISA KEV. The impact is confined to integrity of booking state and outbound email content - there is no code execution, data disclosure, or site takeover - making this a moderate-priority web application flaw (CVSS 5.3).
Stored cross-site scripting in the VK Blocks WordPress plugin (all versions up to and including 1.126.1) allows an authenticated user with contributor-level privileges or above to inject persistent JavaScript through the Group Block's 'linkToPost' feature, which then executes in the browser of anyone who opens the affected page - including higher-privileged editors and administrators who review the content. The defect is insufficient input sanitization combined with missing output escaping (CWE-79), rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with scope change but only low confidentiality and integrity impact and no server-side compromise. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is tempered by the requirement to first obtain a contributor account.
Reflected cross-site scripting in the WordPress plugin Tracking Code Manager (Data443) affects all versions up to and including 2.6.0, allowing unauthenticated attackers to inject arbitrary script into a page by supplying a payload in the TCM_ErrorMessages POST parameter, which the plugin reflects without sanitization or output escaping. Exploitation requires the attacker to lure a victim into submitting a crafted request or clicking a specially crafted link (UI:R), so each target must be individually induced to trigger the payload rather than being compromised by simply browsing a poisoned page. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and no EPSS score was supplied; the flaw is rated moderate (CVSS 6.1) with the main risk being session or credential theft against authenticated site users who are tricked into interacting with the crafted request.
Reflected cross-site scripting in the WordPress plugin Photo Gallery by 10Web - Mobile-Friendly Image Gallery (all versions through 1.8.42) allows unauthenticated attackers to inject arbitrary JavaScript into a page via the 'title' parameter, which the plugin fails to sanitize on input or escape on output. Exploitation is gated on user interaction: a victim - ideally an authenticated administrator - must be lured into clicking an attacker-crafted link, and because the flaw is reflected rather than stored, each target must be tricked individually, so this is assessed as a moderate rather than top-tier priority per our independent assessment (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); WordPress.org plugin tags indicate the flaw is addressed in version 1.8.43.
Stored cross-site scripting in the WordPress plugin "Import and export users and customers" (all versions through 2.4.5) lets authenticated attackers holding only custom-level access inject persistent JavaScript through Custom Column User Meta Profile Fields, which then executes whenever a page rendering that meta is viewed - typically by a higher-privileged administrator reviewing user records. The Wordfence-assigned CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a low-privilege, network-reachable flaw with limited confidentiality and integrity impact but a scope change, because script executes in the context of the reviewing user's session rather than the attacker's own. Exploitation is constrained by the need for prior authentication, an account permitted to write custom user meta, and a victim subsequently loading the injected page, so sites that run this plugin and issue accounts to untrusted users (membership sites, multi-author blogs, customer-facing stores) carry the real risk; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated shortcode injection in the Ocean Extra plugin for WordPress (all versions up to and including 2.6.0) lets remote attackers pass attacker-controlled values into the WordPress do_shortcode() function without proper validation, causing arbitrary registered shortcodes to execute. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), no authentication and no user interaction are required, but real-world impact is bounded by which shortcodes are actually registered on the target site; the practical severity is therefore moderate rather than critical, and no public exploit code or confirmed active exploitation was identified at time of analysis. Note that the OceanWP/Ocean Extra vendor advisory and an upstream code changeset are the primary available intelligence, and no vendor-released fixed version number is independently confirmed.
Stored cross-site scripting in the BoldGrid 'Post and Page Builder - Visual Drag and Drop Editor' WordPress plugin (all versions up to and including 1.27.13) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript inside the Table Designer's 'data-label' attribute, which is stored without adequate sanitization or output escaping and then executes in the browser of any user who later views the injected page. Because the payload is persistent and rendered in the site's origin, successful exploitation can lead to session theft, content tampering, or privilege escalation for the viewing user; CVSS 3.1 score is 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis and no CISA KEV listing; vendor fix is available in version 1.27.14. Sites that restrict content authoring to trusted users are substantially less exposed.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Unauthenticated visitors to WordPress sites running bbPress before 2.6.19 with the BuddyPress integration enabled can read the title, permalink and body of topics and replies posted in public subforums that are nested beneath a private or hidden parent forum. The flaw arises because the hide_sitewide flag applied to BuddyPress activity entries is derived only from a forum's own visibility and ignores the visibility of ancestor forums, so restricted content continues to surface through the sitewide activity stream and the activity REST endpoint. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; exploitation is configuration-dependent (AT:P) and exposure is limited to confidentiality of already-posted forum content, with no integrity or availability impact, so this is a genuine but moderate-priority authorization/disclosure defect rather than a high-urgency threat.
Unauthenticated remote code execution is possible in the WordPress plugin MDTF (wp-meta-data-filter-and-taxonomy-filter) through version 1.3.9, which carries a CWE-94 code injection flaw in PluginUs.Net's metadata/taxonomy filtering component. Per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required, so any site running the vulnerable release with the plugin active is exposed; the NVD score of 5.3 (C:L/I:N/A:N) is materially lower than the assessed C:H/I:H/A:H, and no public exploit code and no CISA KEV listing were identified at time of analysis. Confidence is capped because the signals are thin and internally inconsistent - the unresolved CVSS disagreement and the absence of any named injectable parameter, function, or endpoint mean the minimal precondition confirmed so far is simply the presence of the vulnerable plugin version.
Unauthenticated remote attackers can abuse a missing authorization check (CWE-862) in the WordPress plugin Push Notification for Post and BuddyPress to reach plugin functionality that should be access-controlled, affecting all releases from the initial version through 3.23. The assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5, meaning any exposed site running this niche plugin can be probed by network attackers with no credentials, no user interaction, and no special configuration, but impact stays at low-level data disclosure and modification rather than full site compromise. No public exploit identified at time of analysis; the main exposure limiter is deployment, since only sites with the plugin installed and active are reachable.
Missing authorization checks (CWE-862) in the Magepeople Inc. 'Bus Ticket Booking with Seat Reservation' WordPress plugin, affecting all versions through 5.9.7, let a request reach plugin endpoints that were never gated behind a proper capability or permission check, allowing manipulation or disruption of booking and reservation data. The issue is rated medium severity at CVSS 6.5, with the CVSS impact limited to partial integrity and availability and no confidentiality loss, so realistic damage is tampering with or denial of booking/reservation functionality rather than full site takeover. No public exploit code and no CISA KEV entry were identified at time of analysis, and no vendor-released fixed version is identified in the supplied data; exposure requires the plugin to be installed and active on a WordPress site.
Stored cross-site scripting in the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration, versions through 3.1.0) lets an authenticated low-privileged user plant script content that is persisted server-side and later executed in the browser of any user who views the rendered page, rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Exploitation requires a valid account on the WordPress site (at least low privileges per PR:L) plus a second user who loads the affected content (UI:R), and it presupposes the plugin is installed and active - a niche integration deployment that narrows the realistic target set. Reported by Patchstack; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.
Missing authorization in the miniOrange WP OAuth Server WordPress plugin (all versions through 6.4.0) allows remote unauthenticated attackers to invoke plugin functionality that should have been gated behind capability or permission checks, resulting in low integrity and availability impact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Per the assessed vector, no authentication, privileges, or user interaction are required, so any WordPress site with this plugin active and reachable is potentially exposed; confidentiality impact is rated as none. There is no public exploit identified at time of analysis and no CISA KEV listing, and the available data does not identify a vendor-released patched version.
HTML injection in Responsive Blocks WordPress plugin before 2.3.0 allows unauthenticated remote attackers to place arbitrary HTML, including phishing links, into notification emails sent to the site owner when a crafted value is submitted through the plugin's Form block. The issue is moderate, not critical: the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, so there is no server-side code execution, confidentiality loss, or availability impact, and the injected content only matters if the recipient opens the email and interacts with the attacker-supplied HTML. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) from the provided data.
Payment verification bypass in the Tickera WordPress plugin before 3.6.0.4 allows unauthenticated remote attackers to forge payment notifications and mark arbitrary orders as paid without actually paying. The vulnerability stems from insufficient integrity checking of incoming payment callbacks and a signature that does not cover the order ID or amount, enabling tampering. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported. The independent assessment rates the integrity impact as High.
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Unauthenticated visitors can suppress all auto-inserted snippets for their own requests on WordPress sites running the WPCode plugin before 2.4.0, because the plugin enters its snippet "safe mode" without correctly verifying that the incoming request is genuinely for the login screen. The effect is confined to the attacker's own requests - snippets still execute for every other visitor and no site-wide change occurs - so per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) the result is a low-severity bypass of snippet-enforced behavior (headers, redirects, content/access controls) rather than an outage or global configuration change. Publicly available exploit code exists (WPScan advisory), and there is no CISA KEV confirmation of active exploitation, so real-world priority is modest despite WPCode's wide deployment.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Stored cross-site scripting in GeoDirectory WordPress plugin versions through 2.8.190 allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts through the 'post_title' parameter, which then execute when a victim views the affected listing or page. Exploitation requires a low-privilege account and site settings that permit listing or post submission, and it is not unauthenticated; no public exploit was identified at time of analysis. The CVSS 6.4 score reflects scoped script execution with low confidentiality and integrity impact.
JNews - Jeg Elementor Kit plugin for WordPress (up to and including 3.2.19) is vulnerable to unauthorized data access due to missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX actions. An authenticated attacker with Subscriber-level access or above can exploit this to enumerate all registered users and reconstruct arbitrary users' email addresses character-by-character using a substring search oracle. No public exploit code has been identified at time of analysis, and the issue requires an authenticated low-privilege account, making it a moderate-priority concern rather than a high-urgency emergency.
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.
Stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.3) allows an authenticated user holding 'custom-level' access or above to inject arbitrary JavaScript through the 'content' parameter, which is then rendered without adequate sanitization or output escaping. The injected script is stored server-side and executes in the browser session of any user or administrator who later views the affected page, which is why the CVSS vector scores a scope change (S:C) with low confidentiality and integrity impact (6.4 overall). Exploitation requires a valid low-privileged account on a site that grants custom-level roles, and no public exploit code was identified at time of analysis; this is not listed on CISA KEV and should be handled as a routine patch-management item rather than an emergency.
Stored cross-site scripting in the PeproDev Branches Map (Mapify) WordPress plugin affects every release up to and including 3.0.1, allowing an authenticated attacker holding Contributor-level or higher privileges to save script payloads into plugin-handled page or map content that are later rendered without escaping. The injected script then executes in the browser of any user - including administrators and ordinary visitors - who views the compromised page, yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and a scope change that pushes impact beyond the vulnerable component into the wider WordPress session context. Exploitation requires a valid low-privileged authoring account plus a separate victim viewing the poisoned page; on sites with open registration or loosely granted contributor roles that prerequisite is easy to satisfy, and no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.190) lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through a submitted listing image title (post_images / file_info[2]). The injected script is persisted in the database and executes in the browser of any user who later views the affected listing or map view, scoring 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script runs in the context of the vulnerable site. Exploitation is gated by the need for a valid low-privilege account (the target site must allow registration or the attacker must already hold credentials) and by a victim subsequently loading the tainted page; no public exploit code has been identified at time of analysis.
Missing authorization checks in the 10up WordPress plugin Restricted Site Access (versions through 7.6.2) allow unauthenticated remote visitors to reach content that the plugin's restriction settings are meant to hide, resulting in limited confidentiality disclosure (CVSS 5.3, C:L, no integrity or availability impact). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special network position is required, but the flaw only has effect on sites where the plugin is active and actually configured to restrict visibility - on sites without an active restriction there is nothing to bypass. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; this is a genuine but moderate-severity exposure rather than a high-priority emergency.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.
Price manipulation in the SellKit WordPress plugin before 2.8.0 lets unauthenticated remote attackers place checkout orders at a self-chosen price for any purchasable product, because the plugin trusts a client-supplied price during server-side total recalculation. Publicly available exploit code exists, and EPSS is 0.17% (5th percentile); the vendor has released a patch. The flaw is a business-logic missing-authorization issue (CWE-862) with CVSS 5.3, and impact is limited to integrity-attackers can underpay but cannot read data or disrupt availability.
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).
Stored cross-site scripting in the Donation Thermometer WordPress plugin affects versions 2.2.9 up to but not including 2.3.0, allowing an authenticated user with the Contributor role or higher to inject arbitrary event handlers via an unescaped colour value passed through a shortcode attribute, which then executes in the browser of any higher-privileged user who views or previews the affected page. Publicly available exploit code exists for this flaw per the WPScan advisory, though there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS is low at roughly 0.18% (8th percentile), reflecting the authenticated and user-interaction prerequisites. Realistic exposure is limited to sites that permit untrusted users to register as Contributors or otherwise accept contributor-authored content, since anonymous visitors cannot trigger the injection.
Robokassa Payment Gateway for WooCommerce versions before 1.9.0 accepts incoming payment-notification requests without verifying their authenticity, allowing unauthenticated remote attackers to force any WooCommerce order into a failed state. Because order identifiers are sequential and enumerable, an attacker can walk through the shop's entire order queue one request at a time, removing every order from fulfilment. Publicly available exploit code exists and a vendor patch is available in 1.9.0; EPSS is low (0.17%, 5th percentile) and there is no KEV listing indicating confirmed active exploitation, so this is best treated as a moderate-priority business-logic integrity issue rather than a top-tier emergency.
Information disclosure in the Tainacan WordPress plugin before 1.4.0 lets any authenticated subscriber-level user read the email addresses of the repository's staff by calling reports REST endpoints that lack a management-capability check; the CVSS vector (PR:L) confirms authentication is required, so the attacker needs an existing or self-registered low-privileged WordPress account. Publicly available exploit code exists (referenced from the WPScan advisory), but there is no confirmed active exploitation and EPSS is only 0.17% (6th percentile), placing this at low practical risk. Impact is limited to confidentiality (C:L, CVSS 4.3) and serves reconnaissance or phishing preparation rather than direct system compromise.
Subscriber-level (or higher) users on WordPress sites running rtMedia for WordPress, BuddyPress and bbPress before 4.7.14 can assign uploaded media to an album they do not own or have write permission for, placing content into another user's private album and having it attributed to that victim. The plugin fails to validate album ownership on the upload path (CWE-639, an IDOR/authorization bypass through a user-controlled key), so the only prerequisite is an authenticated account plus the ability to supply a target album identifier - described in the independent assessment as exploitable by an authenticated attacker with PR:L, remote (AV:N), with impact limited to integrity (I:L) and no confidentiality or availability effect, giving an assessed CVSS of 4.3. Publicly available exploit code exists per the WPScan reference tagged as 'exploit', but there is no KEV listing and CISA's SSVC rates exploitation as none and automatable as no, while EPSS is only 0.16% (5th percentile) - consistent with low real-world urgency rather than a top-priority patch item.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid without any payment being made by abusing the hosted-payment return handler in the Trust Payments Gateway for WooCommerce plugin at versions before 3.1.0. Because that callback is not checked for authenticity, not bound to a specific order, and not validated against the amount paid, a single forged request to the public return endpoint is enough to flip an order to paid, and the same path can expose order and customer details. Publicly available exploit code exists (WPScan), but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment records no exploitation, so this is a genuine but moderate-priority integrity and data-exposure issue rather than a mass-exploitation event.
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Contributor-level WordPress users can abuse the FV Flowplayer Video Player plugin's server-side URL fetch routine to probe internal network resources, because the plugin fails to properly validate a user-supplied URL and its existing host-based restriction does not cover every case. Only sites running versions 7.5.44.7212 through 7.5.55.7212 that grant untrusted users Contributor access or above are realistically exposed, and the payoff is a semi-blind oracle: the attacker learns whether an internal host or service responds and its HTTP status code, but never sees the response body, making this a reconnaissance primitive rather than a data-theft vector. Exploitation is authenticated and requires the plugin's URL-based media fetch feature, EPSS is a negligible 0.16 percent (5th percentile), SSVC records no observed exploitation and no automatable path, and while publicly available exploit code exists there is no evidence of active exploitation in the wild; the vendor has shipped a patch in 7.5.55.7212, and this remains a genuinely low-priority issue.
Unauthenticated remote requests targeting the EmbedPress WordPress plugin (all versions before 4.6.8) can force the site to make server-side, credential-bearing calls to a third-party API and then write attacker-controlled cache entries into the site database. Because the vulnerable handler performs no capability or nonce check, any anonymous visitor can trigger it repeatedly, consuming the site owner's metered third-party API quota and inserting unbounded rows into the WordPress database when the plugin is installed, active, and configured with API credentials. Publicly available exploit code exists for this issue, so weaponization is trivial, though the EPSS score is low (0.17%, ~5th percentile), SSVC records no observed exploitation, and there is no confidentiality exposure or remote code execution - impact is limited to integrity/integrity-adjacent resource abuse.
Comment injection in Sunshine Photo Cart before 3.7.4 lets unauthenticated remote attackers submit comments to restricted galleries without satisfying the gallery access restriction, spoofing author name and email; the same restriction is enforced when comments are displayed. Publicly available exploit code exists, but EPSS remains low at 0.13% (2nd percentile), and the issue is integrity-only, allowing attacker-chosen comment content and metadata to be stored in password-protected, email-gated, private, account-only, or expired galleries. No CISA KEV active exploitation is indicated, and the flaw is a genuine but modest-severity integrity issue rather than a critical priority.
Site administrators on a WordPress Multisite network can strip the two-factor authentication configuration of user accounts belonging to other sites - including accounts they are not permitted to edit - in the WP 2FA plugin before version 4.2.0, because the 2FA-removal routine is missing an object-level capability check (CWE-639). The issue is scored CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) and only crosses a genuine trust boundary on Multisite installs, since single-site administrators already manage all users; publicly available exploit code exists, but there is no indication of active exploitation and EPSS is only 0.22% (12th percentile). Impact is limited to removing - not reading, forging, or bypassing inline - another user's 2FA configuration, which weakens that account's authentication posture for as long as the victim does not notice and re-enroll.
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.
SQL injection in the Mail Mint plugin for WordPress (versions up to and including 1.31.4) allows an authenticated attacker with the plugin-specific 'mint_read_contacts' capability to read sensitive database contents through the /wp-json/mrm/v1/segments/contacts REST endpoint. The issue is a genuine but moderate-priority SQL injection rather than a top-tier emergency because the capability is granted only to Administrators by default, although sites that have delegated it to lower-privileged roles via Mail Mint's role manager face greater risk. No public exploit identified at time of analysis; no KEV or EPSS data was provided.
Stored cross-site scripting in the Mang Board WordPress plugin (versions up to and including 2.4.4) allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts into pages via the 'content' parameter by omitting the data_type parameter in a modify request, which bypasses the HTMLPurifier sanitization branch and leaves only reversible mbw_htmlspecialchars2 encoding as a barrier. Exploitation requires only that a victim view the injected Mang Board page, resulting in in-browser script execution with limited confidentiality and integrity impact (CVSS 6.4); this is a moderate-severity issue representing a real but not emergency-level priority, and no public exploit identified at time of analysis. Sites that disable open registration meaningfully limit the attacker pool, and exploitation is specific to versions up to and including 2.4.4.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose.
Arbitrary shortcode execution in the WordPress Broken Link Checker plugin (all versions up to and including 2.4.14.1) allows an unauthenticated commenter to embed a shortcode payload in a comment's href or src attribute; once that comment is approved through the site's normal moderation workflow, the plugin's link parser passes the value to do_shortcode during a scheduled WP-Cron scan, executing the shortcode with no further attacker interaction. The published CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N), but the practical vector carries a user-interaction precondition (UI:R) because moderator approval is required, and impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis.
Authenticated vendor-level users of the Dokan multivendor marketplace plugin for WordPress (all versions up to and including 5.2.1) can reset the WordPress account password of any customer who has placed at least one order with their store, by supplying an arbitrary value to the 'password' parameter of the plugin's REST customers endpoint. The flaw is a CWE-639 insecure direct object reference: the endpoint's object-level guard only verifies that the target user is one of the requesting vendor's own customers, and never blocks changes to login-identity fields, so a vendor can overwrite the stored password hash and then log in as that customer for a limited account takeover. Vendor access required to exploit this can be self-obtained through the public 'I am a vendor' registration flow when that option is enabled, but the practical impact is bounded - the attacker must already hold a vendor or custom-level account and can only target customers with an existing order relationship; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Directory traversal in the WordPress plugin 'Debloat - Remove Unused CSS, Optimize JS' (all versions through 1.3.0) allows remote attackers to read arbitrary files on the server via crafted input in the 's' search parameter. According to our independent assessment, the CVSS vector is AV:N/AC:H/PR:N/UI:N (unauthenticated, no user interaction), so the trigger is a single crafted GET request to the public search endpoint - but only after a site administrator has enabled the plugin's 'Optimize CSS' feature with the default 'Inline Google Fonts' option active, which is why the attack is rated AC:H and conditional rather than universally exploitable. Impact is read-only confidentiality loss (C:H, I:N, A:N), typically exposing wp-config.php and other sensitive files subject to web-server/PHP file permissions; no public exploit code has been identified at time of analysis and there is no KEV listing, making this a moderate, conditionally-exploitable issue rather than a top-tier emergency.
Authenticated SQL injection in the FluentCart WordPress eCommerce plugin, affecting all versions up to and including 1.7.0, lets users who hold shop-management privileges slip attacker-chosen keys into an unprepared bulk-product-update query and read arbitrary data out of the site's database. The vulnerable path is the product bulk-update flow, and on FluentCart Pro installs the non-administrator 'Manager' shop role carries the products/edit permission and can therefore trigger it without administrator access - which is why the effective privilege requirement is moderate rather than high. Reported by Wordfence, this is a genuine but constrained issue rather than an urgent fire-drill: no public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is confined to confidentiality (database read/extraction) with no integrity or availability effect.
Stored cross-site scripting in the Cooked - Recipe Management plugin for WordPress (all versions up to and including 1.16.1) lets an authenticated attacker with contributor-level access or above embed arbitrary JavaScript through the [cooked-timer] shortcode, which is stored and then executed in the browser of any user - including an administrator - who later views the injected post, page, or recipe. The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handling (CWE-79), and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N places it at 6.4, a moderate-severity issue contingent on the attacker already holding a contributor+ account on a site running the vulnerable plugin. There is confirmed actively exploited status? No - no public exploit identified at time of analysis, and no CISA KEV listing; treat this as a routine patch-management priority rather than an emergency.
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.
Arbitrary shortcode execution in the Popup Box plugin for WordPress (ays-pro) versions 6.4.1 through 6.4.2 lets unauthenticated remote attackers invoke any shortcode registered on the site with attacker-chosen attributes, because client-controlled IP-related HTTP headers are folded into a popup body and then run through do_shortcode(). The attack is only reachable when a site administrator has manually inserted the %%user_ip_address%% token into a popup's Custom Content body, so default installations and sites that never use that token are not affected; impact is bounded by the shortcodes already installed (no direct PHP injection), which is why the assessed vector scores only 4.8 with high attack complexity. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor reference points to a fix in 6.4.3.
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Missing authorization in the WordPress plugin Login with Phone Number (all versions through 1.8.77) allows any authenticated user, including a low-privileged registered account, to perform a plugin action that should be reserved for a higher-privileged role. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (score 4.3), the attacker must already hold an account on the target site, the attack is network-reachable with no user interaction, and the impact is limited to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Missing authorization in the WebberZone Knowledge Base plugin for WordPress (versions through 3.2.0) allows unauthenticated remote attackers to reach knowledge base content that the plugin's access-control settings were intended to restrict. Because the CVSS vector is PR:N/UI:N, no account or victim interaction is needed; the exposure is limited to confidentiality (C:L, CVSS 5.3), with no write or availability impact. No public exploit code has been identified at time of analysis, and there is no confirmed CISA KEV entry, so real-world exploitation is not established from the available data.
Unauthenticated remote attackers can exploit missing authorization in the WP Desk Flexible Quantity (Measurement Price Calculator for WooCommerce) plugin, versions up to and including 2.3.23, to modify a constrained set of data with low integrity impact. The flaw, tracked as CWE-862 and rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), requires no authentication or user interaction, but the exact affected feature is unspecified. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Sunshine Photo Cart (WordPress plugin) versions up to 3.7.4 are affected by a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass access controls and read limited sensitive data from the plugin, such as cart or customer information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, but impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis.
Missing authorization in the WPdreams Ajax Search Lite WordPress plugin (versions through 4.14.5) allows unauthenticated remote attackers to read access-controlled data, resulting in low confidentiality impact. The vulnerability has a CVSS score of 5.3 and requires no authentication or user interaction; no public exploit identified at time of analysis. Site administrators should update the plugin as soon as a fixed version is available.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.
Missing authorization in the WPExperts WP EasyPay plugin (versions through 4.5.4) leaves a plugin-provided endpoint or action reachable by unauthenticated remote requests, so an attacker with network access to a WordPress site running the vulnerable plugin can invoke restricted functionality and read data they should not be able to reach. The reported CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning no credentials, no user interaction, and no non-default configuration are required, but the impact is confined to limited confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and no EPSS score was provided in the available intelligence, so exploitation risk currently rests on the ease of reaching the unauthenticated endpoint rather than on confirmed active abuse.
Stored cross-site scripting in the YITH WooCommerce Compare plugin for WordPress (versions through 3.15.0) lets an authenticated low-privilege user persist malicious script that executes in the browser of any other user, including an administrator, who later views the affected page. The flaw is rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, meaning it is reachable over the network but requires a pre-existing low-privileged account and victim interaction, so it is not exploitable by a fully unauthenticated attacker against a default install. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, lets an authenticated low-privilege user persist a malicious script through a plugin-controlled input field, which then executes in the browser of any privileged user who later views the affected page or admin screen. The vulnerability carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting that exploitation needs a valid low-privileged account plus a victim's page load, but that the resulting script runs with scope change into the surrounding admin context. No public exploit identified at time of analysis, and the flaw is a moderate rather than top-tier priority given the authentication and user-interaction gates.
Authenticated users with low-privileged WordPress accounts can exploit an insecure direct object reference (IDOR) in the Simply Schedule Appointments plugin through version 1.6.12.35 to read and alter appointment and booking records belonging to other users, because the plugin's endpoints accept a user-controlled object key without verifying ownership. The flaw requires valid credentials (CVSS vector PR:L, so it is not pre-auth) and yields only partial confidentiality and integrity impact rather than full site takeover; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate, authenticated-user authorization weakness rather than an emergency. Sites that grant subscriber-level or other low-privilege accounts are the primary exposure surface.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Missing authorization controls in the Meow Apps AI Engine WordPress plugin (all versions through 3.8.3) let an authenticated low-privileged user reach a plugin feature or endpoint whose access-control level is incorrectly configured, granting limited unauthorized modification (C:N/I:L/A:N) rather than data disclosure or service disruption. Exploitation requires a valid WordPress account with at least low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so unauthenticated visitors cannot trigger it, and only sites running the plugin at or below 3.8.3 are exposed. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuine but modest-priority broken-access-control issue reported through Patchstack.
Broken access control in the WordLift WordPress plugin (all versions through 3.54.15) lets an authenticated low-privilege user - a subscriber or contributor is sufficient - reach functionality that should be reserved for higher-privileged roles, yielding limited data disclosure and modification with a CVSS 3.1 score of 5.4 (C:L/I:L, no availability impact). Exploitation requires only a valid account on a site running the plugin, which makes open-registration, membership, and multi-author sites the most exposed; no user interaction is needed. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), so this is a moderate, not critical, priority - but it should be remediated promptly because the barrier to entry is a free account.
Stored cross-site scripting (XSS) in the Crocoblock JetSmartFilters WordPress plugin through version 3.8.6 lets an authenticated low-privileged user (CVSS PR:L, e.g., contributor or author) inject a persistent payload into filter-handled input that is improperly neutralized before web page generation, and the script then executes in the browser of a higher-privileged victim such as an administrator who views the affected page (UI:R). The issue is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), is a moderate-severity CWE-79 defect, and there is no public exploit code or confirmed active exploitation identified at time of analysis; it is not exploitable against a default site without a valid account on the target WordPress installation.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) allows an authenticated user with access to a plugin input field that persists data to store a malicious script which later executes in the browser of any other user viewing the affected page, including administrators. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires an authenticated low-privileged account plus subsequent victim interaction, and no public exploit code has been identified at time of analysis. Impact is bounded to the victim's browser session rather than direct server compromise, but the scope change (S:C) means the injected script can act with the victim's privileges against the surrounding application.
Code injection in the WPMU DEV Broken Link Checker WordPress plugin, affecting all versions up to and including 2.4.14.1, allows an unauthenticated remote attacker to feed crafted input to the plugin's link-checking/parsing routine and potentially expose sensitive data. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), exploitation is network-reachable and needs no privileges, but a victim must be induced to trigger the vulnerable action, and the confirmed impact is confined to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis.
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Authenticated Contributor-level users on WordPress sites running Blog2Social up to 9.1.4 can read arbitrary post titles and content, including private and pending posts owned by other users, through an insecure direct object reference in the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. The flaw is a low-severity information disclosure (CVSS 4.3, CWE-639) that requires a valid Contributor account; no public exploit identified at time of analysis and no confirmed active exploitation. It matters most on multi-author, membership, or guest-contributor sites where Contributor accounts are broadly assigned, because single-author installs expose little or no data beyond what the attacker can already see.
Sensitive information exposure in the Elementor Website Builder plugin for WordPress through version 4.2.3 lets any authenticated user with contributor-level access or higher read the full post_content and the plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors. Successful exploitation only requires a low-privileged account on the affected site and no victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), making open-registration, membership, and multi-author sites that hand out contributor roles the most exposed. This is a moderate, authorization-gap issue (CWE-862, Missing Authorization) rather than a high-urgency flaw; no public exploit was identified at the time of analysis.
Order status manipulation in Rede Itaú for WooCommerce before 5.5.3 allows unauthenticated remote attackers to change arbitrary WooCommerce order states - including marking unpaid orders as paid and cancelling completed orders - by forging payment gateway webhook requests. Publicly available exploit code exists, though the impact is limited to integrity (CVSS 5.3) and requires the plugin to be installed and its webhook endpoint reachable. No special configuration or user interaction is needed, but exposure is limited to merchants using the Itaú (Brazil) payment gateway.
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.
Unauthenticated attackers can forge payment notifications against WordPress/WooCommerce stores running the Cardinity Payment Gateway plugin before version 3.4.2, because the plugin ships with an empty notification signing secret and fails to properly validate the authenticity of incoming callbacks. By sending a crafted 'approved payment' (or 'failed') notification to the plugin's payment-callback handler, a remote attacker with no credentials and no user interaction can mark arbitrary orders as paid - payment fraud - or force legitimate orders into a failed state. The vulnerability is exploitable against default installations, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation in the wild; impact is bounded to order-status manipulation rather than code execution, data theft, or service disruption.
Unauthenticated visitors to WordPress sites running the Spin Wheel plugin before 2.2.1 can bypass the plugin's spin-validation logic and retrieve the coupon codes stored for any campaign, including campaigns that have not been published. Because the plugin does not confirm that a legitimate spin actually occurred before handing back and consuming a configured prize, an attacker can repeatedly harvest the full pool of stored coupon codes and drain a campaign's prize inventory; the flaw is remotely reachable with no authentication, user interaction, or special configuration, and publicly available exploit code exists. Scored at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), the impact is confined to the coupon/prize feature and does not provide a path to code execution or broader site compromise.
Missing capability checks in the Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 allow any authenticated user - a Subscriber is sufficient per the CVSS vector (PR:L, authenticated) - to invoke plugin AJAX actions that read the URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs. Exploitation is conditional rather than opportunistic: the attacker needs a low-privileged account on the site, and an administrator must have already run the plugin's content scanner so that the harvested URL set exists, which is what drives the High attack complexity (AC:H) in the CVSS 4.2 score. Publicly available exploit code exists and the issue is fixed in version 2.0.2, but it is not listed in CISA KEV, and the exposure is meaningfully reduced on sites that disable open registration. This is a genuine but modest-priority issue, not a high-severity emergency.
Unauthenticated attackers can invoke several cancellation-related AJAX actions in the eaSYNC Booking WordPress plugin before 1.3.31 because those actions lack authorization and nonce validation, letting them create booking cancellation requests, fire booking notification emails, and overwrite the content of emails the site sends. Publicly available exploit code exists (the WPScan advisory is the exploit reference), but there is no indication of confirmed active exploitation in CISA KEV. The impact is confined to integrity of booking state and outbound email content - there is no code execution, data disclosure, or site takeover - making this a moderate-priority web application flaw (CVSS 5.3).
Stored cross-site scripting in the VK Blocks WordPress plugin (all versions up to and including 1.126.1) allows an authenticated user with contributor-level privileges or above to inject persistent JavaScript through the Group Block's 'linkToPost' feature, which then executes in the browser of anyone who opens the affected page - including higher-privileged editors and administrators who review the content. The defect is insufficient input sanitization combined with missing output escaping (CWE-79), rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with scope change but only low confidentiality and integrity impact and no server-side compromise. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is tempered by the requirement to first obtain a contributor account.
Reflected cross-site scripting in the WordPress plugin Tracking Code Manager (Data443) affects all versions up to and including 2.6.0, allowing unauthenticated attackers to inject arbitrary script into a page by supplying a payload in the TCM_ErrorMessages POST parameter, which the plugin reflects without sanitization or output escaping. Exploitation requires the attacker to lure a victim into submitting a crafted request or clicking a specially crafted link (UI:R), so each target must be individually induced to trigger the payload rather than being compromised by simply browsing a poisoned page. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and no EPSS score was supplied; the flaw is rated moderate (CVSS 6.1) with the main risk being session or credential theft against authenticated site users who are tricked into interacting with the crafted request.
Reflected cross-site scripting in the WordPress plugin Photo Gallery by 10Web - Mobile-Friendly Image Gallery (all versions through 1.8.42) allows unauthenticated attackers to inject arbitrary JavaScript into a page via the 'title' parameter, which the plugin fails to sanitize on input or escape on output. Exploitation is gated on user interaction: a victim - ideally an authenticated administrator - must be lured into clicking an attacker-crafted link, and because the flaw is reflected rather than stored, each target must be tricked individually, so this is assessed as a moderate rather than top-tier priority per our independent assessment (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); WordPress.org plugin tags indicate the flaw is addressed in version 1.8.43.
Stored cross-site scripting in the WordPress plugin "Import and export users and customers" (all versions through 2.4.5) lets authenticated attackers holding only custom-level access inject persistent JavaScript through Custom Column User Meta Profile Fields, which then executes whenever a page rendering that meta is viewed - typically by a higher-privileged administrator reviewing user records. The Wordfence-assigned CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a low-privilege, network-reachable flaw with limited confidentiality and integrity impact but a scope change, because script executes in the context of the reviewing user's session rather than the attacker's own. Exploitation is constrained by the need for prior authentication, an account permitted to write custom user meta, and a victim subsequently loading the injected page, so sites that run this plugin and issue accounts to untrusted users (membership sites, multi-author blogs, customer-facing stores) carry the real risk; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated shortcode injection in the Ocean Extra plugin for WordPress (all versions up to and including 2.6.0) lets remote attackers pass attacker-controlled values into the WordPress do_shortcode() function without proper validation, causing arbitrary registered shortcodes to execute. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), no authentication and no user interaction are required, but real-world impact is bounded by which shortcodes are actually registered on the target site; the practical severity is therefore moderate rather than critical, and no public exploit code or confirmed active exploitation was identified at time of analysis. Note that the OceanWP/Ocean Extra vendor advisory and an upstream code changeset are the primary available intelligence, and no vendor-released fixed version number is independently confirmed.
Stored cross-site scripting in the BoldGrid 'Post and Page Builder - Visual Drag and Drop Editor' WordPress plugin (all versions up to and including 1.27.13) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript inside the Table Designer's 'data-label' attribute, which is stored without adequate sanitization or output escaping and then executes in the browser of any user who later views the injected page. Because the payload is persistent and rendered in the site's origin, successful exploitation can lead to session theft, content tampering, or privilege escalation for the viewing user; CVSS 3.1 score is 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis and no CISA KEV listing; vendor fix is available in version 1.27.14. Sites that restrict content authoring to trusted users are substantially less exposed.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Unauthenticated visitors to WordPress sites running bbPress before 2.6.19 with the BuddyPress integration enabled can read the title, permalink and body of topics and replies posted in public subforums that are nested beneath a private or hidden parent forum. The flaw arises because the hide_sitewide flag applied to BuddyPress activity entries is derived only from a forum's own visibility and ignores the visibility of ancestor forums, so restricted content continues to surface through the sitewide activity stream and the activity REST endpoint. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; exploitation is configuration-dependent (AT:P) and exposure is limited to confidentiality of already-posted forum content, with no integrity or availability impact, so this is a genuine but moderate-priority authorization/disclosure defect rather than a high-urgency threat.
Unauthenticated remote code execution is possible in the WordPress plugin MDTF (wp-meta-data-filter-and-taxonomy-filter) through version 1.3.9, which carries a CWE-94 code injection flaw in PluginUs.Net's metadata/taxonomy filtering component. Per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required, so any site running the vulnerable release with the plugin active is exposed; the NVD score of 5.3 (C:L/I:N/A:N) is materially lower than the assessed C:H/I:H/A:H, and no public exploit code and no CISA KEV listing were identified at time of analysis. Confidence is capped because the signals are thin and internally inconsistent - the unresolved CVSS disagreement and the absence of any named injectable parameter, function, or endpoint mean the minimal precondition confirmed so far is simply the presence of the vulnerable plugin version.
Unauthenticated remote attackers can abuse a missing authorization check (CWE-862) in the WordPress plugin Push Notification for Post and BuddyPress to reach plugin functionality that should be access-controlled, affecting all releases from the initial version through 3.23. The assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5, meaning any exposed site running this niche plugin can be probed by network attackers with no credentials, no user interaction, and no special configuration, but impact stays at low-level data disclosure and modification rather than full site compromise. No public exploit identified at time of analysis; the main exposure limiter is deployment, since only sites with the plugin installed and active are reachable.
Missing authorization checks (CWE-862) in the Magepeople Inc. 'Bus Ticket Booking with Seat Reservation' WordPress plugin, affecting all versions through 5.9.7, let a request reach plugin endpoints that were never gated behind a proper capability or permission check, allowing manipulation or disruption of booking and reservation data. The issue is rated medium severity at CVSS 6.5, with the CVSS impact limited to partial integrity and availability and no confidentiality loss, so realistic damage is tampering with or denial of booking/reservation functionality rather than full site takeover. No public exploit code and no CISA KEV entry were identified at time of analysis, and no vendor-released fixed version is identified in the supplied data; exposure requires the plugin to be installed and active on a WordPress site.
Stored cross-site scripting in the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration, versions through 3.1.0) lets an authenticated low-privileged user plant script content that is persisted server-side and later executed in the browser of any user who views the rendered page, rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Exploitation requires a valid account on the WordPress site (at least low privileges per PR:L) plus a second user who loads the affected content (UI:R), and it presupposes the plugin is installed and active - a niche integration deployment that narrows the realistic target set. Reported by Patchstack; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.
Missing authorization in the miniOrange WP OAuth Server WordPress plugin (all versions through 6.4.0) allows remote unauthenticated attackers to invoke plugin functionality that should have been gated behind capability or permission checks, resulting in low integrity and availability impact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Per the assessed vector, no authentication, privileges, or user interaction are required, so any WordPress site with this plugin active and reachable is potentially exposed; confidentiality impact is rated as none. There is no public exploit identified at time of analysis and no CISA KEV listing, and the available data does not identify a vendor-released patched version.
HTML injection in Responsive Blocks WordPress plugin before 2.3.0 allows unauthenticated remote attackers to place arbitrary HTML, including phishing links, into notification emails sent to the site owner when a crafted value is submitted through the plugin's Form block. The issue is moderate, not critical: the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, so there is no server-side code execution, confidentiality loss, or availability impact, and the injected content only matters if the recipient opens the email and interacts with the attacker-supplied HTML. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) from the provided data.
Payment verification bypass in the Tickera WordPress plugin before 3.6.0.4 allows unauthenticated remote attackers to forge payment notifications and mark arbitrary orders as paid without actually paying. The vulnerability stems from insufficient integrity checking of incoming payment callbacks and a signature that does not cover the order ID or amount, enabling tampering. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported. The independent assessment rates the integrity impact as High.
Payment bypass in WPForms Lite (versions before 2.0.2.2) allows unauthenticated visitors to submit forms that are configured to use the plugin's PayPal Commerce gateway without ever completing payment, because the plugin does not perform a server-side check that PayPal recorded a completed order before accepting the submission. The form confirmation is still delivered and notification emails are still sent even though no order exists at the payment provider and no payment is recorded, making this a business-logic integrity flaw (CVSS 5.3, I:L; no confidentiality or availability impact) rather than a system-compromise bug. Exploitation is limited to sites that have enabled the PayPal Commerce gateway on a form - forms using other gateways or no payment at all are out of scope - and while publicly available exploit code exists, there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Unauthenticated visitors can suppress all auto-inserted snippets for their own requests on WordPress sites running the WPCode plugin before 2.4.0, because the plugin enters its snippet "safe mode" without correctly verifying that the incoming request is genuinely for the login screen. The effect is confined to the attacker's own requests - snippets still execute for every other visitor and no site-wide change occurs - so per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) the result is a low-severity bypass of snippet-enforced behavior (headers, redirects, content/access controls) rather than an outage or global configuration change. Publicly available exploit code exists (WPScan advisory), and there is no CISA KEV confirmation of active exploitation, so real-world priority is modest despite WPCode's wide deployment.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Stored cross-site scripting in GeoDirectory WordPress plugin versions through 2.8.190 allows authenticated attackers with subscriber-level access or higher to inject arbitrary scripts through the 'post_title' parameter, which then execute when a victim views the affected listing or page. Exploitation requires a low-privilege account and site settings that permit listing or post submission, and it is not unauthenticated; no public exploit was identified at time of analysis. The CVSS 6.4 score reflects scoped script execution with low confidentiality and integrity impact.
JNews - Jeg Elementor Kit plugin for WordPress (up to and including 3.2.19) is vulnerable to unauthorized data access due to missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX actions. An authenticated attacker with Subscriber-level access or above can exploit this to enumerate all registered users and reconstruct arbitrary users' email addresses character-by-character using a substring search oracle. No public exploit code has been identified at time of analysis, and the issue requires an authenticated low-privilege account, making it a moderate-priority concern rather than a high-urgency emergency.
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.
Stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.3) allows an authenticated user holding 'custom-level' access or above to inject arbitrary JavaScript through the 'content' parameter, which is then rendered without adequate sanitization or output escaping. The injected script is stored server-side and executes in the browser session of any user or administrator who later views the affected page, which is why the CVSS vector scores a scope change (S:C) with low confidentiality and integrity impact (6.4 overall). Exploitation requires a valid low-privileged account on a site that grants custom-level roles, and no public exploit code was identified at time of analysis; this is not listed on CISA KEV and should be handled as a routine patch-management item rather than an emergency.
Stored cross-site scripting in the PeproDev Branches Map (Mapify) WordPress plugin affects every release up to and including 3.0.1, allowing an authenticated attacker holding Contributor-level or higher privileges to save script payloads into plugin-handled page or map content that are later rendered without escaping. The injected script then executes in the browser of any user - including administrators and ordinary visitors - who views the compromised page, yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and a scope change that pushes impact beyond the vulnerable component into the wider WordPress session context. Exploitation requires a valid low-privileged authoring account plus a separate victim viewing the poisoned page; on sites with open registration or loosely granted contributor roles that prerequisite is easy to satisfy, and no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Stored cross-site scripting in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.190) lets an authenticated attacker with subscriber-level access or above inject arbitrary JavaScript through a submitted listing image title (post_images / file_info[2]). The injected script is persisted in the database and executes in the browser of any user who later views the affected listing or map view, scoring 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a scope change because the script runs in the context of the vulnerable site. Exploitation is gated by the need for a valid low-privilege account (the target site must allow registration or the attacker must already hold credentials) and by a victim subsequently loading the tainted page; no public exploit code has been identified at time of analysis.
Missing authorization checks in the 10up WordPress plugin Restricted Site Access (versions through 7.6.2) allow unauthenticated remote visitors to reach content that the plugin's restriction settings are meant to hide, resulting in limited confidentiality disclosure (CVSS 5.3, C:L, no integrity or availability impact). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special network position is required, but the flaw only has effect on sites where the plugin is active and actually configured to restrict visibility - on sites without an active restriction there is nothing to bypass. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; this is a genuine but moderate-severity exposure rather than a high-priority emergency.
Unauthenticated information disclosure in the AWP Classifieds WordPress plugin before version 4.4.9 lets remote attackers read the private contact email address stored on any listing by submitting a request to the ad submission page that references a payment transaction. The plugin omits the ownership/authorisation check on that code path, so no account, login, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); the only exposure is the listing's private contact email, not credentials, content modification, or site control. Publicly available exploit code exists and WPScan published a proof-of-concept write-up, but there is no KEV entry and EPSS is low at 0.19% (8th percentile), so this is a genuine low-to-moderate priority issue affecting only sites running this optional plugin with listings that store private contact emails.
Unauthenticated remote attackers can delete or overwrite stored abandoned-cart records in the WordPress plugin Cart Abandonment Recovery for WooCommerce (all versions before 2.1.4) by supplying a customer's email address, which the plugin uses as the record key without verifying that the requester owns that address (CWE-639, CVSS 5.3). Exploitation requires only a known or guessable email per target record, so the attacker cannot mass-wipe blindly without an email list, and the impact is confined to abandoned-cart data - no passwords, orders, or payment details are exposed given C:N/I:L and SSVC technical impact of partial. No confirmed active exploitation has been reported (not in CISA KEV), but publicly available exploit code exists per WPScan and EPSS is 0.17% (5th percentile), indicating a genuine yet low real-world risk that is fully resolved by upgrading to 2.1.4.
Unauthenticated attackers can mark WooCommerce orders as paid without any payment taking place on sites running the Paymentfor Gateway for WooCommerce plugin before 1.0.6, because the plugin never verifies that an inbound payment notification actually came from the payment provider. Exploitation is simple for anyone who can reach the gateway's notification (callback/IPN) endpoint and reference an existing order - publicly available exploit code exists, and no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - but the risk is real yet bounded, since only stores that installed and enabled this specific gateway are affected. EPSS is low at 0.17% (5th percentile), there is no CISA KEV listing, and a vendor fix is available in version 1.0.6.
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.
Price manipulation in the SellKit WordPress plugin before 2.8.0 lets unauthenticated remote attackers place checkout orders at a self-chosen price for any purchasable product, because the plugin trusts a client-supplied price during server-side total recalculation. Publicly available exploit code exists, and EPSS is 0.17% (5th percentile); the vendor has released a patch. The flaw is a business-logic missing-authorization issue (CWE-862) with CVSS 5.3, and impact is limited to integrity-attackers can underpay but cannot read data or disrupt availability.
Authenticated users holding the WordPress Contributor role or higher can delete arbitrary post meta on any post - including content owned by administrators and other higher-privileged users - on sites running the YITH WooCommerce Popup plugin before version 1.60.0, because the plugin fails to verify the requester's capability before performing the deletion. The impact is integrity-only (no confidentiality or availability loss, no code execution), and while publicly available exploit code exists, EPSS is low at 0.16% and there is no CISA KEV confirmation of active exploitation. The vendor has released a fixed version (1.60.0).
Stored cross-site scripting in the Donation Thermometer WordPress plugin affects versions 2.2.9 up to but not including 2.3.0, allowing an authenticated user with the Contributor role or higher to inject arbitrary event handlers via an unescaped colour value passed through a shortcode attribute, which then executes in the browser of any higher-privileged user who views or previews the affected page. Publicly available exploit code exists for this flaw per the WPScan advisory, though there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS is low at roughly 0.18% (8th percentile), reflecting the authenticated and user-interaction prerequisites. Realistic exposure is limited to sites that permit untrusted users to register as Contributors or otherwise accept contributor-authored content, since anonymous visitors cannot trigger the injection.
Robokassa Payment Gateway for WooCommerce versions before 1.9.0 accepts incoming payment-notification requests without verifying their authenticity, allowing unauthenticated remote attackers to force any WooCommerce order into a failed state. Because order identifiers are sequential and enumerable, an attacker can walk through the shop's entire order queue one request at a time, removing every order from fulfilment. Publicly available exploit code exists and a vendor patch is available in 1.9.0; EPSS is low (0.17%, 5th percentile) and there is no KEV listing indicating confirmed active exploitation, so this is best treated as a moderate-priority business-logic integrity issue rather than a top-tier emergency.
Information disclosure in the Tainacan WordPress plugin before 1.4.0 lets any authenticated subscriber-level user read the email addresses of the repository's staff by calling reports REST endpoints that lack a management-capability check; the CVSS vector (PR:L) confirms authentication is required, so the attacker needs an existing or self-registered low-privileged WordPress account. Publicly available exploit code exists (referenced from the WPScan advisory), but there is no confirmed active exploitation and EPSS is only 0.17% (6th percentile), placing this at low practical risk. Impact is limited to confidentiality (C:L, CVSS 4.3) and serves reconnaissance or phishing preparation rather than direct system compromise.
Subscriber-level (or higher) users on WordPress sites running rtMedia for WordPress, BuddyPress and bbPress before 4.7.14 can assign uploaded media to an album they do not own or have write permission for, placing content into another user's private album and having it attributed to that victim. The plugin fails to validate album ownership on the upload path (CWE-639, an IDOR/authorization bypass through a user-controlled key), so the only prerequisite is an authenticated account plus the ability to supply a target album identifier - described in the independent assessment as exploitable by an authenticated attacker with PR:L, remote (AV:N), with impact limited to integrity (I:L) and no confidentiality or availability effect, giving an assessed CVSS of 4.3. Publicly available exploit code exists per the WPScan reference tagged as 'exploit', but there is no KEV listing and CISA's SSVC rates exploitation as none and automatable as no, while EPSS is only 0.16% (5th percentile) - consistent with low real-world urgency rather than a top-priority patch item.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on stores running the Asaas Gateway for WooCommerce plugin before 2.7.8, because the plugin's payment webhook accepts an empty access token under its default configuration and never confirms that the notified payment actually belongs to the order it updates (CWE-287 improper authentication). Exploitation needs only the vulnerable plugin installed, active, and network-reachable in its default state, and publicly available exploit code exists; CISA's SSVC decision data records no observed exploitation and EPSS is low at 0.22% (12th percentile). The impact is confined to integrity of order payment status - no data disclosure or availability loss - but stores that auto-fulfill or auto-provision on a 'paid' status can suffer fraudulent fulfillment and revenue loss.
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid without any payment being made by abusing the hosted-payment return handler in the Trust Payments Gateway for WooCommerce plugin at versions before 3.1.0. Because that callback is not checked for authenticity, not bound to a specific order, and not validated against the amount paid, a single forged request to the public return endpoint is enough to flip an order to paid, and the same path can expose order and customer details. Publicly available exploit code exists (WPScan), but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment records no exploitation, so this is a genuine but moderate-priority integrity and data-exposure issue rather than a mass-exploitation event.
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Contributor-level WordPress users can abuse the FV Flowplayer Video Player plugin's server-side URL fetch routine to probe internal network resources, because the plugin fails to properly validate a user-supplied URL and its existing host-based restriction does not cover every case. Only sites running versions 7.5.44.7212 through 7.5.55.7212 that grant untrusted users Contributor access or above are realistically exposed, and the payoff is a semi-blind oracle: the attacker learns whether an internal host or service responds and its HTTP status code, but never sees the response body, making this a reconnaissance primitive rather than a data-theft vector. Exploitation is authenticated and requires the plugin's URL-based media fetch feature, EPSS is a negligible 0.16 percent (5th percentile), SSVC records no observed exploitation and no automatable path, and while publicly available exploit code exists there is no evidence of active exploitation in the wild; the vendor has shipped a patch in 7.5.55.7212, and this remains a genuinely low-priority issue.
Unauthenticated remote requests targeting the EmbedPress WordPress plugin (all versions before 4.6.8) can force the site to make server-side, credential-bearing calls to a third-party API and then write attacker-controlled cache entries into the site database. Because the vulnerable handler performs no capability or nonce check, any anonymous visitor can trigger it repeatedly, consuming the site owner's metered third-party API quota and inserting unbounded rows into the WordPress database when the plugin is installed, active, and configured with API credentials. Publicly available exploit code exists for this issue, so weaponization is trivial, though the EPSS score is low (0.17%, ~5th percentile), SSVC records no observed exploitation, and there is no confidentiality exposure or remote code execution - impact is limited to integrity/integrity-adjacent resource abuse.
Comment injection in Sunshine Photo Cart before 3.7.4 lets unauthenticated remote attackers submit comments to restricted galleries without satisfying the gallery access restriction, spoofing author name and email; the same restriction is enforced when comments are displayed. Publicly available exploit code exists, but EPSS remains low at 0.13% (2nd percentile), and the issue is integrity-only, allowing attacker-chosen comment content and metadata to be stored in password-protected, email-gated, private, account-only, or expired galleries. No CISA KEV active exploitation is indicated, and the flaw is a genuine but modest-severity integrity issue rather than a critical priority.
Site administrators on a WordPress Multisite network can strip the two-factor authentication configuration of user accounts belonging to other sites - including accounts they are not permitted to edit - in the WP 2FA plugin before version 4.2.0, because the 2FA-removal routine is missing an object-level capability check (CWE-639). The issue is scored CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) and only crosses a genuine trust boundary on Multisite installs, since single-site administrators already manage all users; publicly available exploit code exists, but there is no indication of active exploitation and EPSS is only 0.22% (12th percentile). Impact is limited to removing - not reading, forging, or bypassing inline - another user's 2FA configuration, which weakens that account's authentication posture for as long as the victim does not notice and re-enroll.