WordPress
Monthly
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
Unauthenticated information disclosure in the GamiPress WordPress plugin (affected versions 7.9.5 up to but not including 8.0.6) lets remote attackers retrieve private activity-log entries belonging to any user on the site without logging in, as no authentication, user interaction, or non-default configuration is required. The issue is an incomplete fix of CVE-2026-13450, meaning the earlier attempt to lock down these log entries left a bypass that still permits access to another user's private activity data. Publicly available exploit code exists and the flaw is fully automatable, though CISA's SSVC assessment records no observed exploitation; EPSS is low at roughly 0.19% (8th percentile), and the impact is confined to read-only leakage of activity-log content, so sensitivity depends on how the site uses GamiPress tracking.
Arbitrary activity-log disclosure in the GamiPress WordPress plugin before 8.0.6 lets any authenticated user - including a lowest-privilege Subscriber - read other users' points balances and earned achievements, plus the usernames of administrators who manually awarded or revoked points, by invoking one authenticated AJAX action that performs neither a capability check nor an ownership verification. The issue is remotely reachable with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, CWE-639) and is read-only, with no integrity or availability impact. Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low (0.17%, 6th percentile), so it ranks as a low-to-moderate priority for sites with open user registration.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored HTML and link injection in the LTL Freight Quotes WordPress plugin before version 4.2.19 allows unauthenticated remote attackers to submit unsanitized values that are persisted and later rendered to storefront visitors. The plugin performs neither an authorization check nor input sanitization before storing these request values, so exploitation requires no authentication, no user interaction, and no special configuration on a default installation. Impact is limited to injected markup and links - the assessed vector (C:N/I:L/A:N) confirms no script execution, data confidentiality loss, or availability impact - and a publicly available exploit exists, though the EPSS score of 0.13% (2nd percentile) signals low real-world urgency, consistent with CISA's SSVC rating of no observed exploitation.
Unauthenticated configuration tampering in the LTL Freight Quotes WordPress plugin before 4.2.19 allows remote attackers to modify some of the plugin's stored settings by calling a REST route that performs no authorization check or input validation before writing to the database (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Only WordPress sites running this specific plugin below version 4.2.19 are exposed, and the assessed impact is integrity-only - settings can be altered, but the flaw does not permit data disclosure or site takeover. Publicly available exploit code exists and has been documented by WPScan, though there is no confirmed active exploitation (CISA KEV does not list this CVE) and EPSS is very low at 0.17% (6th percentile).
Authenticated users holding only subscriber-level accounts can modify, corrupt, or delete media-library attachments owned by other users-including administrators-through the Classified Listing WordPress plugin before 6.1.1. The defect is a missing-authorization flaw (CWE-862) triggered specifically when a gallery request references an unattached media item, which the plugin fails to check for ownership or edit capability. Publicly available exploit code exists and the plugin is a confirmed target for the WPScan research team, but there is no KEV listing or independent evidence of active exploitation, and EPSS is a low 0.17% (6th percentile); impact is confined to integrity and partial availability with no confidentiality loss (C:N).
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.
NEX-Forms WordPress plugin versions 9.2.1 up to (but not including) 9.3.1 fail to perform any authorization, ownership, or request-validation check before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted entry by simply referencing its sequential identifier. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); publicly available exploit code exists, though CISA SSVC records no observed exploitation and EPSS is low at 0.16% (5th percentile), so this is a genuine but moderate-priority issue. Impact is confined to stored form-submission data - integrity and availability are rated Low, with no confidentiality loss and no compromise of the underlying WordPress host.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Unauthenticated remote attackers can delete the stored SEO analysis data held by the Rank Math SEO WordPress plugin in any version before 1.0.280, because the routine that wipes that data enforces neither a capability check nor a nonce. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, 5.3) reflects an unauthenticated, network-reachable integrity-only impact: confidentiality and availability are untouched, so the realistic damage ceiling is loss of the plugin's cached SEO analysis results rather than site compromise or downtime. Publicly available exploit code exists and the vendor has shipped a fix, but CISA's SSVC evaluation rates exploitation as "none" and EPSS is only 0.17% (5th percentile), so this is a low-to-moderate priority issue and not confirmed actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
SQL injection in WooCommerce Polylang Integration plugin versions up to and including 1.5.0 allows authenticated attackers with Subscriber-level access to extract sensitive information from the WordPress database via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The flaw requires the plugin to be active and a low-privileged account, which is easily obtained on WooCommerce sites allowing customer registration. No public exploit code has been identified at time of analysis, and the impact is limited to data confidentiality.
Stored cross-site scripting in the Social Share Buttons & Analytics plugin - GetSocial.io for WordPress (all versions up to and including 4.5) lets an authenticated attacker with at least subscriber-level access save arbitrary JavaScript through the 'response' parameter into the gs-alert-msg, gs-alert-utm and gs-alert-cta options, which then executes in an administrator's browser when the GetSocial settings page is opened. Exploitation is constrained: the payload is not immediate and only fires on that specific wp-admin page, and the attacker must already hold a low-privileged account on the target site (for example through open registration). There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV; the assessment is that this is a genuinely moderate, not high-priority, issue.
Unauthenticated information disclosure in the Avada (Fusion) Builder WordPress plugin (all versions up to and including 3.16.1) lets remote attackers read arbitrary WordPress user meta - including administrator email addresses and login names, the wp_user_level field, and WooCommerce customer PII such as billing_email, billing_phone and billing_address_1 - for any user ID by supplying a crafted args[link_target] value. The one prerequisite is that the target site must render the [fusion_instagram] shortcode on some page, because the required awb-instagram-nonce is printed in plaintext inside fusionInstagramVars there and can be harvested by any anonymous visitor before the exploit request is sent; no authentication or user interaction is otherwise required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is greatest on WooCommerce-enabled sites where billing data lives in user meta, and no public exploit code was identified at time of analysis (not listed in CISA KEV); the flaw is a CWE-200 exposure whose practical priority is moderate given the low confidentiality-only impact and the shortcode precondition.
Stored cross-site scripting in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) affects all versions up to and including 8.10.2.1, letting an attacker with a subscriber-level account inject arbitrary JavaScript through the 'phone' listing field that then executes in the browser of any user viewing the affected listing page. The weakness is reachable because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role by default, so a subscriber can submit and publish a listing with no administrator moderation; the primary real-world prerequisite is therefore a site that allows open or self-service user registration. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as CVE-2026-100185 by Wordfence, this is a moderate-severity issue that sits below top-priority status, and at the time of analysis there is no public exploit identified and no CISA KEV confirmation of active exploitation, though the low privilege bar makes it more practical than its modest impact metrics suggest.
Stored cross-site scripting in the PO/MO Editor WordPress plugin, affecting all versions up to and including 1.4.2, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary script through the 'podata' parameter, which the plugin persists and later serves as a replacement .po/.mo translation file via its load_textdomain_mofile filter. Because the injected translation is rendered for any visitor loading an affected page, a low-privilege account on a site with open registration enabled is sufficient to seed persistent script execution in other users' browsers; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) reflects network reachability, no user interaction beyond page view, scope change, and limited confidentiality and integrity impact with no availability effect. Exploitation requires the plugin to be installed and active plus a valid low-privilege account, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Countdown Timer - Widget Countdown through version 3.0.1 allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages by supplying a malicious 'redirect_url' shortcode attribute. Because the payload is persisted, the script executes in the browser of any user - including administrators - who later views the injected page, yielding limited confidentiality and integrity impact within the affected site's origin (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is gated by the requirement for a contributor-or-higher account on a site running the plugin.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.
Arbitrary file deletion in the Database Addon for Contact Form 7 - CFDB7 WordPress plugin through version 1.4.1 allows unauthenticated attackers to inject a crafted multipart submission field whose name contains the substring 'cfdb7_file' and whose value is an arbitrary filesystem path; the plugin stores that non-form-tag field and later passes it to unlink() without basename()/realpath() normalisation or any check that the file belongs to that submission. Because deletion does not occur at submission time but only when an administrator bulk-deletes the poisoned entry from wp-admin, successful exploitation depends on privileged operator interaction, which is why the independent assessment rates it CVSS 5.3 (MEDIUM) with UI:R while retaining PR:N and network reachability. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
Premium Addons for Elementor, a WordPress plugin that extends the Elementor page builder, fails to enforce an authorization check on at least one of its functions in versions up to and including 4.11.110, allowing remote attackers to reach functionality or data that should be restricted. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable with no credentials and no user interaction required, so default installations are exposed, but the scored impact is confined to LOW confidentiality (C:L/I:N/A:N) - read access to limited information or a restricted action rather than site takeover. There is no CISA KEV entry and no publicly available exploit code identified at time of analysis, so this is a moderate-severity, low-priority issue best handled through routine plugin patch cycles.
ThemeGrill's User Registration WordPress plugin (versions up to and including 5.2.8) fails to enforce authorization checks on one of its endpoints, letting a low-privilege authenticated user perform actions that should be restricted. Exploitation requires a valid session (CVSS PR:L), but because the plugin's core purpose is open self-service registration, an attacker can typically create the necessary account themselves - no user interaction is needed and the attack is remote and low-complexity. Impact is limited to integrity and availability of the affected functionality (I:L/A:L, no confidentiality impact), rated CVSS 5.4; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the WordPress 'Books Gallery' plugin (wp-books-gallery) affects all releases through 4.8.4, allowing an attacker to persist malicious JavaScript that executes in the browser of whoever later views the affected page. Per our assessment, exploitation requires an authenticated WordPress account with at least low-level posting privileges (CVSS vector PR:L) plus victim interaction (UI:R) - a privileged user or site visitor must load the page where the injected payload is rendered - so this is not remotely exploitable without credentials, and real-world risk is materially constrained by those prerequisites. Rated CVSS 6.5 by Patchstack and mapped to CWE-79, this is a moderate-severity issue with no public exploit identified at time of analysis and no CISA KEV listing; exposure is confined to WordPress sites running the Books Gallery plugin at version 4.8.4 or earlier.
WordPress sites running the ThemeGrill User Registration plugin through version 5.2.8 can be queried by unauthenticated remote attackers to retrieve embedded sensitive data, because a missing authorization check (CWE-862) leaves a data-exposing code path reachable without any privilege. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, and the impact is confined to Low confidentiality with no integrity or availability effect - the attacker gains read access to specific exposed data rather than full account or site compromise. Exploitation is limited to sites that have not upgraded past 5.2.8, and there is no public exploit identified at time of analysis and no confirmation of active exploitation (not listed in CISA KEV); this is a routine patch-management item rather than an emergency.
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authenticated low-privilege user - realistically anyone who can complete the plugin's own self-service sign-up form when open registration is enabled - persist malicious script into plugin-stored data that later renders in a victim's browser. The payload only fires when a higher-privileged user, typically an administrator reviewing registrations or user records, loads the affected page, so exploitation requires that human view-step and is not automatable against an idle target; CVSS is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the flaw is scope-changing it can affect resources beyond the plugin's own security context.
Information disclosure in Active Products Tables for WooCommerce through version 2.1.3 lets unauthenticated remote visitors retrieve embedded sensitive data from rendered product tables. The issue is CWE-201 and is rated CVSS 5.3 with low confidentiality impact only, no integrity or availability impact; WordPress/WooCommerce sites running the affected plugin are exposed. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Cross-site request forgery (CSRF) in the ThemeGrill User Registration WordPress plugin through version 5.2.8 allows remote attackers to trick a logged-in privileged user into performing unintended actions, with low integrity and availability impact (CVSS 5.4). Exploitation requires an active authenticated WordPress session and successful social engineering to load attacker-controlled content (UI:R), as reflected in the CVSS vector (PR:N, UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate-severity, low-priority issue for most defenders.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Missing access control checks in ThemeGrill's User Registration plugin for WordPress, versions through 5.2.8, let unauthenticated remote users (CVSS PR:N/UI:N) reach restricted functionality that should require higher privileges, resulting in low-impact disclosure of protected data (C:L, I:N, A:N). The issue is rated moderate at CVSS 5.3 and does not by itself enable account takeover, data modification, or code execution, so its practical value to an attacker is information gathering rather than full compromise. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the specific registration endpoint or feature that is improperly authorized is not named in the available data, so the exact exposure surface remains unscoped pending the vendor advisory.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Stored cross-site scripting (XSS) in the Prime Slider - Addons For Elementor WordPress plugin (bdthemes-prime-slider-lite) through version 4.7.1 lets an authenticated low-privileged user persist malicious script through slider/Elementor widget content, which then executes in the browser of any higher-privileged user who views the affected page (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored server-side and fires on page render, the practical impact is session/token theft, content injection, or privileged actions performed in the victim's context - though exploitation is not remote-unauthenticated and requires the victim to interact with the poisoned page. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-priority, not a drop-everything, issue.
Stored cross-site scripting in PowerPack Addons for Elementor through version 3.1.0 allows authenticated users who can create or edit PowerPack widget content to inject persistent JavaScript that executes when another user views the affected page. The independent assessment rates this as a moderate-priority issue rather than an urgent one: exploitation requires a lower-privileged authenticated WordPress account, typically contributor/author level, and a second user must load the tampered content (UI:R), with scope change but only low confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis, no CISA KEV entry, and no EPSS score was supplied in the provided data.
FluentBoards through version 2.1.0 contains a missing authorization flaw that allows an authenticated low-privilege WordPress user to perform actions outside their intended role, with limited confidentiality and integrity impact. The plugin must be installed and active, and the assessed CVSS vector requires PR:L, so this is not an unauthenticated bypass. No public exploit code or confirmed active exploitation was identified in the provided intelligence; the primary source is the Patchstack advisory.
Stored cross-site scripting in Premium Addons for Elementor (versions through 4.11.110) allows an authenticated low-privilege WordPress user to persist malicious JavaScript through plugin widget input, which then runs in the browser of any user who views the poisoned page. Exploitation requires a content-editing account such as contributor or author (PR:L) plus a victim loading the affected page (UI:R), so single-author and tightly locked-down sites have little exposure while multi-author sites or those with open registration granting posting roles are the primary targets. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS data was supplied with the available intelligence.
Missing authorization in the Amelia WordPress booking plugin (TMS Amelia) through version 2.4.10 allows unauthenticated remote attackers to tamper with restricted plugin actions due to insufficient access control checks. This medium-severity flaw (CVSS 5.3, CWE-862) carries only limited integrity impact (I:L) with no effect on confidentiality or availability, and no public exploit or active exploitation has been identified at time of analysis. Affected are WordPress sites running the plugin at version 2.4.10 or earlier; the issue requires no authentication, user interaction, or non-default configuration per the CVSS vector.
Missing authorization in the WordPress plugin WP User Manager (all versions through 2.9.23) allows remote attackers to reach plugin functionality that should be protected by access-control checks, disclosing limited information. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with confidentiality-only impact (C:L/I:N/A:N), exploitation requires no authentication and no user interaction against any site running the vulnerable plugin version, but the consequences are capped at low-severity information exposure. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base score of 5.3 and the Patchstack-reported broken access control classification, this is a moderate, low-priority finding that still warrants patching or virtual patching on internet-facing WordPress sites.
Missing authorization in the Pay for Payment for WooCommerce WordPress plugin (all versions through 3.0.1) allows unauthenticated remote attackers to reach functionality that should require an elevated capability, with impact limited to a low-integrity effect. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium), no authentication or user interaction is required, but no data disclosure or denial of service results; the site must have the plugin installed and active at version 3.0.1 or earlier and the vulnerable action must be network-reachable. No confirmed active exploitation and no public exploit code were identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureForms WordPress plugin (all versions through 2.12.7) allows an authenticated low-privileged user to inject script payloads through form fields that execute when a higher-privileged user, typically an administrator, later views the stored submission. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires an existing submission-capable account plus victim-driven user interaction, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An unauthenticated remote attacker can invoke access-controlled functionality in the Fullworks Plugins Quick Paypal Payments WordPress plugin (versions through 6.0.3) because the plugin does not enforce the authorization checks that gate those code paths. Successful exploitation yields a bounded Low integrity impact - an attacker can reach and manipulate plugin/payment-related data but cannot read confidential data or affect availability through this issue alone, which is why this is a moderate-risk, not high-priority, issue per our assessment. No public exploit code was identified at time of analysis and the plugin has no CISA KEV listing, but the endpoint is trivially reachable over the network with no credentials or user interaction required, and no vendor-released fixed version is confirmed in the available data.
Second-order SQL injection in the Animated Number Counters WordPress plugin (all versions up to and including 3.0) allows an authenticated user with editor-level capabilities or higher to plant a crafted 'counterid' value that is later concatenated unsanitized into SQL queries, enabling extraction of sensitive data from the WordPress database. Successful exploitation requires the attacker to first store the payload through the plugin's counter-save feature and then trigger the vulnerable read/render path, so the privilege requirement (PR:H) keeps realistic risk moderate rather than critical. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, although the vulnerability class and the appearance of an upstream code change in the plugin repository make prompt patching advisable for any site granting editor accounts to untrusted users.
Sensitive information exposure in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress lets any authenticated user at subscriber level or above pull diagnostic and environment data out of the site through the plugin's ai_wp_footer_hook code path, affecting all releases up to and including 2.8.18. The leaked material spans the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and every post meta value - including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the main constraint is the account requirement, so sites that allow open subscriber self-registration have a materially larger exposure surface than sites that restrict registration to trusted users.
Unauthenticated retrieval of embedded sensitive data is possible on WordPress sites running the WPGraphQL plugin through version 2.23.1, because the plugin omits an authorization check on the affected GraphQL operation (CWE-862). Any network-reachable instance exposes the flaw to unauthenticated requesters requiring no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3), with impact confined to low confidentiality loss and no integrity or availability effect. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the practical exposure is limited to sites that run the plugin and publish their GraphQL endpoint, and this is assessed as a genuine but moderate-priority issue rather than a top-tier emergency.
Unauthenticated arbitrary file upload in the WP-BusinessDirectory WordPress plugin (through version 4.0.2) allows remote attackers to write files with attacker-controlled content to attacker-chosen locations on the web server. Any default installation running the vulnerable plugin with the upload endpoint reachable is exposed without credentials or user interaction, but the plugin vendor notes that this arbitrary write does not translate into code execution on a default server configuration - achieving remote code execution requires a non-default or misconfigured server (for example, writable and executable web paths) or chaining with a second weakness. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); this is a moderate-severity integrity issue that warrants patching but is not a drop-everything emergency on the available signals.
Stored cross-site scripting in the WP Testimonials WordPress plugin (all versions through 1.4.13) lets an authenticated user holding the Author role or higher persist JavaScript inside testimonial content, which then executes in the browser of any user - including an administrator - who later views the rendered testimonials (assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The plugin not only fails to escape testimonial output but actively reverses WordPress's built-in HTML sanitization when rendering it, so the payload survives despite core protections, and exploitation needs no non-default settings. Impact is gated by the Author-level privilege requirement plus a victim subsequently loading the affected page, so single-author or single-admin sites with no untrusted accounts are materially less exposed; at time of analysis there is no CISA KEV entry and no public exploit code identified, and the flaw was reported to WPScan (tracked as EUVD-2026-98299).
Stored cross-site scripting in the Griden 'Responsive Slider' WordPress plugin (versions through 0.1.9) allows an authenticated user with at least low-level privileges to persist malicious JavaScript into slider content, which then executes in the browser of any visitor who renders the affected page. Because the payload is stored server-side and fires on victim page views, exploitation requires a victim to interact with the compromised slider (UI:R), while the attacker only needs rights sufficient to edit slider content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5). No public exploit code has been identified at time of analysis and the plugin is not reported as actively exploited (no CISA KEV listing); risk is elevated for multi-author or low-trust-administration WordPress sites where untrusted accounts can edit slider content.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the IMPress for IDX Broker WordPress plugin (versions through 3.3.1) allows an authenticated low-privilege user - such as a contributor or author who can submit data through an IMPress input field - to persist malicious JavaScript that executes in the browser of any other user, including an administrator, who later views the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects that exploitation is not unauthenticated: it requires a valid low-privilege account on the target site plus victim interaction, and it only applies where the plugin is installed and active. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); Patchstack is credited with the report.
Stored cross-site scripting in the Weaver Xtreme Theme Support WordPress plugin (all versions through 7.0.1) allows an authenticated user with only low-level posting privileges to persist malicious JavaScript that then executes in the browser of any user who loads the affected page, including administrators. Rated CVSS 3.1 6.5 (Medium) with a scope-change vector (S:C) and requiring victim interaction (UI:R), the flaw is a CWE-79 improper-neutralization issue reported by Patchstack. No public exploit code has been identified at time of analysis and no fixed version is confirmed in the available data, so exposure is greatest on multi-author installations that grant untrusted accounts content-creation rights. Note that per the CVSS vector (PR:L) this is not exploitable by unauthenticated remote attackers.
Missing authorization in the RocketGeek WP-Members WordPress plugin through version 3.5.7 permits authenticated low-privilege users-such as self-registered members-to bypass incorrectly configured access-control security levels, resulting in limited confidentiality and integrity impact. Rated CVSS 5.4 (CWE-862), the flaw requires a valid low-privilege account that is readily obtainable on sites with open registration, and its effect is amplified when membership security levels are misconfigured. No public exploit or active exploitation is identified in the provided intelligence.
Race condition in the Pixelite Events Manager WordPress plugin (versions through 7.4.7) lets a remote, unauthenticated attacker target a narrow synchronization window in the plugin's handling of a shared resource, resulting in a limited integrity impact with no confidentiality or availability effect. Exploitation hinges on winning a concurrency race - tightly-timed overlapping requests must land inside the vulnerable window (CVSS AC:H), a probabilistic timing requirement that substantially reduces reliability and keeps overall severity low. No public exploit has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated remote attackers can supply their own values for web parameters that the VillaTheme Salevo (woo-boost-sales) WordPress plugin treats as immutable, letting them tamper with the data the plugin accepts and acts on in versions up through 1.3.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 5.3) confirms the request path needs no authentication, no user interaction, and no non-default configuration, but the impact is capped at a partial integrity loss with no confidentiality or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority hardening item rather than an emergency patch, with real exposure confined to sites that actually run this specific plugin.
Stored cross-site scripting (XSS) in BdThemes Element Pack Elementor Addons versions up to and including 8.8.8 allows an authenticated attacker with low-level content-editing privileges to inject malicious scripts that execute in the browser of a higher-privileged user who views the affected page. This moderate-severity vulnerability (CVSS 6.5) requires victim interaction and is not exploitable without authentication; no public exploit code has been identified at time of analysis.
Missing authorization in the WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams, versions through 7.5.13) lets an attacker who already holds a low-privilege account on the site bypass the plugin's access-control checks and read information that should be restricted to higher-privileged users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) confirms it is remotely reachable, requires no user interaction, and is limited to a confidentiality disclosure of low severity, with no integrity or availability impact; the scope change (S:C) reflects that the weakness lets the attacker reach resources beyond the plugin component itself. Exploitation status is no public exploit identified at time of analysis - there is no KEV listing and no published proof-of-concept code - and the practical prerequisite is that the attacker must first register or otherwise obtain a low-privilege session on a site running the vulnerable version.
Missing authorization in the VideoWhisper Broadcast Live Video WordPress plugin (all versions through 7.3.6) allows an authenticated low-privilege user to invoke plugin functionality they are not entitled to and alter site content or plugin settings without holding the required capability. The impact is integrity-only (CVSS 4.3, C:N/I:L/A:N), scope is unchanged, and no confidentiality loss or denial of service results. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and the assessed exploitation conditions (a valid low-privileged account on a site with the plugin enabled) place real-world risk at low priority rather than urgent.
Stored cross-site scripting in the Premium Addons for Elementor WordPress plugin (through version 4.11.110) lets an authenticated user with low-level content-contribution privileges plant persistent JavaScript inside Elementor-built pages or widgets, which then executes in the browser of any user who renders that content. The CVSS 6.5 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity attack that requires an account with at least contributor/author-tier access and victim interaction, with the changed-scope (S:C) metric indicating the injected script acts in the context of the site origin rather than a confined component. Only sites running the plugin at or below 4.11.110 are affected, and no public exploit code or CISA KEV entry was identified at time of analysis.
This moderate-severity DOM-based cross-site scripting issue affects the ExpressTech Quiz And Survey Master WordPress plugin through version 11.2.7. An authenticated attacker with at least low-level privileges can supply input that is later rendered into a client-side DOM sink, causing script execution in the browser of a victim who interacts with the affected quiz or survey page. The CVSS 3.1 score is 6.5 (Medium); no public exploit was identified at time of analysis, and exploitation requires victim interaction.
Missing authorization in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.58.0) allows unauthenticated remote attackers to reach functionality that should be gated by an access-control check, resulting in low-impact but unauthenticated disclosure of site data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates no credentials, no user interaction and no special complexity are needed against an affected installation, though the impact is confined to confidentiality (no integrity or availability loss). No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data, so the practical risk is medium and primarily affects sites still running 1.58.0 or earlier.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Stored cross-site scripting in the Ad Inserter WordPress plugin (all versions through 2.8.18) allows an authenticated low-privilege user - a contributor, author, or any role permitted to create or edit ad blocks - to persist malicious script into plugin ad configuration, which then executes in the browser of another user, typically an administrator, when that page or the plugin's settings screen is rendered. Successful exploitation is bounded by two prerequisites: the attacker must already hold a suitably privileged WordPress account, and a second user must view the poisoned content, so this is not remotely exploitable against a default install by an anonymous visitor. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5, moderate), and no public exploit identified at time of analysis; EPSS data was not supplied, so no exploitation-probability estimate can be cited.
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Missing authorization checks in the WP User Manager plugin for WordPress (versions through 2.9.22) let an authenticated low-privileged user invoke plugin functionality that should be restricted to higher-privileged roles, resulting in unauthorized integrity changes rather than data disclosure or disruption. The flaw is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning remote exploitation is possible but requires a valid low-privileged account (PR:L) and only affects integrity (C:N/A:N); because the plugin provides front-end registration and profile management, such accounts are frequently self-obtainable on sites with open registration enabled, which materially raises practical reach even though fully anonymous attackers cannot exploit it. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so this is best treated as a modest-priority, high-volume WordPress plugin hardening issue rather than an urgent emergency.
Missing authorization in the WP Desk Flexible Subscriptions WordPress plugin, affecting all versions through 1.8.4, lets an authenticated low-privilege user (for example a registered customer or subscriber, PR:L) invoke plugin functionality that lacks a proper capability check, altering data the account should not be able to change. Impact is limited to partial integrity loss - no confidentiality or availability effect and no scope change - giving it a moderate CVSS 3.1 base score of 4.3, and exploitation requires a valid session on the target WordPress/WooCommerce site. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, not a priority, issue.
Missing authorization in the Codection 'Products Restricted Users for WooCommerce' WordPress plugin, version 0.7 and earlier, allows unauthenticated remote attackers to bypass the plugin's access-control logic and alter which products are restricted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required against a default installation, although the impact is limited to low integrity (C:N/I:L/A:N) on plugin-controlled restriction state rather than data disclosure or denial of service. No public exploit code was identified at time of analysis, and the plugin has a narrow deployment footprint, so this is a moderate rather than high priority finding.
Stored cross-site scripting in the WordPress plugin Custom Query Blocks through version 5.6.0 lets an authenticated low-privilege user (for example a contributor or author) inject script that executes in the browser of any other user who later views the affected page, including administrators. The plugin fails to neutralize stored input before rendering it during web page generation (CWE-79), and exploitation requires both valid account credentials and a victim who loads the injected content, so the attack is not fully automatable. With a CVSS base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), impact is scoped to the victim's session and page context, and no public exploit code has been identified at time of analysis.
Low-privilege authenticated users can bypass access-control checks in the WordPress 'Event post' plugin (versions from initial release through 6.1.1), allowing them to perform event-management actions and read or modify event data they are not authorized to touch. The flaw is a CWE-862 missing authorization issue scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires an existing account on the target site at subscriber/contributor-level privilege or higher - unauthenticated visitors cannot trigger it directly, though self-registration or any low-privilege account lowers the bar. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; impact is limited to partial confidentiality and integrity of event data with no availability effect.
Authenticated users with only low privileges (for example a WordPress subscriber or registered WooCommerce customer) can reach at least one TMDS dropshipping plugin action that performs no authorization check, allowing them to make unauthorized state changes against a WordPress site running TMDS 1.0.15 or earlier. The vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects limited integrity and availability impact with no confidentiality loss, and exploitation requires a valid low-privilege account, so the practical risk is moderate rather than critical. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied; only a Patchstack advisory (credited as the reporting source) documents the issue.
Missing authorization in the WordPress plugin VideoWhisper Site Manager for ChatGPT, Claude, Codex (all versions through 1.2.10) lets an authenticated low-privilege site user reach plugin functionality that should require higher capabilities, resulting in limited confidentiality and integrity impact at CVSS 5.4. The flaw is a broken access control condition (CWE-862) requiring only a valid WordPress account on a site with the plugin active (PR:L), remote reachability and low attack complexity with no user interaction; availability is unaffected. No public exploit code was identified at time of analysis, and this does not by itself permit full site takeover or denial of service.
Authenticated users of a WordPress site running the Paid Videochat Turnkey Site plugin (ppv-live-webcams) through version 7.5.12 can manipulate quantity/specified-value input parameters because the plugin fails to properly validate them (CWE-1284). Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable but demands a logged-in account and yields only limited integrity impact, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-severity, low-priority hardening item rather than an urgent threat.
Authorization bypass through a user-controlled key in the WordPress 'Event Post' plugin (NOUS Ouvert Utile et Simple), affecting all versions through 6.1.1, allows an authenticated low-privilege user to reference and manipulate event objects belonging to other users by supplying a crafted identifier. The flaw is a classic IDOR (CWE-639) caused by an incorrectly configured access-control check, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity impact only, with no confidentiality or availability loss and no user interaction required. The primary precondition is that the attacker holds any authenticated account on the target site, so exposure is greatest on sites that permit open or untrusted user registration; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fixed version appears in the available advisory data.
Input data manipulation in WP Desk Flexible Quantity - Measurement Price Calculator for WooCommerce through 2.3.22 lets unauthenticated remote attackers alter submitted quantity or measurement values because the plugin does not properly validate those inputs (CWE-1284). The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so impact is limited to integrity of pricing/quantity calculations, with no read, denial-of-service, or code-execution impact. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the provided data.
Insecure direct object reference in the Hotel Booking WordPress plugin (versions through 3.8) lets any authenticated user - a Subscriber-level account is sufficient - retrieve booking records that belong to other customers by supplying a booking identifier they do not own. Because the plugin performs no ownership check on the requested record, an attacker can harvest customer PII including names, email addresses, phone numbers, and postal addresses; the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms a network-reachable, low-privilege, read-only confidentiality impact with no integrity or availability effect. The issue is significantly easier to reach on sites that allow public user self-registration, which is common for hospitality bookings; no public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is a genuine but moderate-priority authorization defect rather than an emergency.
Cross-site request forgery in the Hotel Booking WordPress plugin (versions through 3.8) lets an attacker forge administrative requests that create, delete, or modify booking order records inside an administrator's authenticated browser session, yielding a limited integrity-only impact (CVSS 4.3, C:N/I:L/A:N). The attacker needs no account of their own (PR:N), but the attack only succeeds if a logged-in administrator is tricked into loading an attacker-controlled page or hidden auto-submitting form (UI:R), which is the primary limiting factor. No public exploit code has been identified at time of analysis, and confidentiality and availability are not affected - only the accuracy of booking order data is at risk.
Authenticated users holding only subscriber-level privileges can permanently delete every comment on a WordPress site running the WP Comment Cleaner plugin in versions 6.1 up to (but not including) 7.2, because one of its bulk comment-deletion routines performs no capability check and no nonce validation (CWE-862). Scored CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the flaw is a moderate-priority access-control weakness confined to destruction of comment data, with no confidentiality or service-availability impact, rather than a code-execution emergency. No public exploit identified at time of analysis, but practical exploitation is easiest on sites that allow self-service registration, since that lets any attacker obtain the minimal account required; sites that disable open registration and tightly control accounts substantially shrink the attacker population.
Stored cross-site scripting in the HireZoot WordPress plugin before version 4.0.0 lets an authenticated user who holds the plugin's management capability (Administrator by default) store a script payload in a job specification setting that is later rendered without escaping in an admin-area settings page and executes in the browser of any administrator who opens that page. Because the payload runs inside the viewing administrator's session, any impact is bounded by that administrator's own privileges, and the flaw is only a meaningful privilege escalation where administrators lack the unfiltered_html capability - WordPress multisite installs or sites with DISALLOW_UNFILTERED_HTML defined - since on default single-site installations administrators can already inject unfiltered HTML. This is a low-priority, network-reachable issue (CVSS 3.5, PR:H, UI:R) and no public exploit was identified at time of analysis; the vendor has shipped a fix in version 4.0.0.
Symlink following in the nginx third-party module ngx_cache_purge before 3.0.4 allows a local attacker to cause deletion of files outside the configured proxy_cache_path: the module's purge walks (purge_all, wildcard purge, or a plain proxy_cache_purge PURGE request) trust nginx's ngx_walk_tree(), which classifies directory entries with stat() and therefore descends into planted symlinks. Exploitation is narrow - it requires that nginx and a served application such as WordPress run under the same OS user account and that the attacker already has that user's file-write or code-execution capability to plant the link - and no public exploit code or confirmed in-the-wild activity was identified at time of analysis, with the assessed CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) reflecting a genuinely low-priority, local-only, high-complexity issue. Version 3.0.4 blocks symlinks found inside the cache tree but does not close an applicable TOCTOU race condition, so the shared-user deployment remains the decisive risk factor.
Information disclosure in the WP-Invoice WordPress plugin through version 4.3.1 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email addresses, display names and profile details of every registered user on the site by invoking AJAX handlers that perform no capability checks. The issue is network-exploitable with low attack complexity (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires only a valid logged-in account, which an attacker can often self-provision when public user registration is enabled. Publicly available exploit code exists, but CISA's SSVC assessment records no known exploitation at time of analysis, and no KEV listing applies. Because the leaked roster of names and emails is directly reusable for phishing and credential-targeting, the practical risk is moderate for sites with open registration and low for closed-membership deployments.
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.
SQL injection in the paymendo WordPress plugin (all versions through 1.1) lets an authenticated user with only low privileges inject arbitrary SQL through a request parameter that is not sanitized or escaped before being placed into a query, exposing database contents to read-out. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability, no user interaction, and a high confidentiality impact with no integrity or availability effect, and publicly available exploit code exists. The authentication requirement is the key limiting factor: on sites that allow self-service registration, a subscriber account is all that is needed, while closed-registration sites require the attacker to already hold valid credentials.
Blind SQL injection in the paymendo WordPress plugin through version 1.1 allows unauthenticated remote attackers to extract sensitive data from the underlying database via an unsanitized parameter. Publicly available exploit code exists, though no CISA KEV listing indicates active exploitation at time of analysis; no EPSS score was provided. The vulnerability is rated medium severity (CVSS 6.5) and affects any WordPress site with the vulnerable plugin active.
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL query string when the optional auto-login-after-registration feature is enabled, leaving the credential exposed in browser history and in web server, reverse-proxy, and CDN access logs (fixed in 4.8.3). Publicly available exploit code exists, but the exposure is strictly conditional: the vulnerable feature is not on by default, and an attacker must already have local access to the registrant's browser profile or privileged read access to the log stores named in the advisory. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms some level of local or privileged access is required and that only confidentiality is impacted, making this a genuine-but-low-priority information-disclosure issue rather than an urgent remote flaw.
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
Unauthenticated information disclosure in the GamiPress WordPress plugin (affected versions 7.9.5 up to but not including 8.0.6) lets remote attackers retrieve private activity-log entries belonging to any user on the site without logging in, as no authentication, user interaction, or non-default configuration is required. The issue is an incomplete fix of CVE-2026-13450, meaning the earlier attempt to lock down these log entries left a bypass that still permits access to another user's private activity data. Publicly available exploit code exists and the flaw is fully automatable, though CISA's SSVC assessment records no observed exploitation; EPSS is low at roughly 0.19% (8th percentile), and the impact is confined to read-only leakage of activity-log content, so sensitivity depends on how the site uses GamiPress tracking.
Arbitrary activity-log disclosure in the GamiPress WordPress plugin before 8.0.6 lets any authenticated user - including a lowest-privilege Subscriber - read other users' points balances and earned achievements, plus the usernames of administrators who manually awarded or revoked points, by invoking one authenticated AJAX action that performs neither a capability check nor an ownership verification. The issue is remotely reachable with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3, CWE-639) and is read-only, with no integrity or availability impact. Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low (0.17%, 6th percentile), so it ranks as a low-to-moderate priority for sites with open user registration.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored HTML and link injection in the LTL Freight Quotes WordPress plugin before version 4.2.19 allows unauthenticated remote attackers to submit unsanitized values that are persisted and later rendered to storefront visitors. The plugin performs neither an authorization check nor input sanitization before storing these request values, so exploitation requires no authentication, no user interaction, and no special configuration on a default installation. Impact is limited to injected markup and links - the assessed vector (C:N/I:L/A:N) confirms no script execution, data confidentiality loss, or availability impact - and a publicly available exploit exists, though the EPSS score of 0.13% (2nd percentile) signals low real-world urgency, consistent with CISA's SSVC rating of no observed exploitation.
Unauthenticated configuration tampering in the LTL Freight Quotes WordPress plugin before 4.2.19 allows remote attackers to modify some of the plugin's stored settings by calling a REST route that performs no authorization check or input validation before writing to the database (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Only WordPress sites running this specific plugin below version 4.2.19 are exposed, and the assessed impact is integrity-only - settings can be altered, but the flaw does not permit data disclosure or site takeover. Publicly available exploit code exists and has been documented by WPScan, though there is no confirmed active exploitation (CISA KEV does not list this CVE) and EPSS is very low at 0.17% (6th percentile).
Authenticated users holding only subscriber-level accounts can modify, corrupt, or delete media-library attachments owned by other users-including administrators-through the Classified Listing WordPress plugin before 6.1.1. The defect is a missing-authorization flaw (CWE-862) triggered specifically when a gallery request references an unattached media item, which the plugin fails to check for ownership or edit capability. Publicly available exploit code exists and the plugin is a confirmed target for the WPScan research team, but there is no KEV listing or independent evidence of active exploitation, and EPSS is a low 0.17% (6th percentile); impact is confined to integrity and partial availability with no confidentiality loss (C:N).
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.
NEX-Forms WordPress plugin versions 9.2.1 up to (but not including) 9.3.1 fail to perform any authorization, ownership, or request-validation check before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted entry by simply referencing its sequential identifier. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); publicly available exploit code exists, though CISA SSVC records no observed exploitation and EPSS is low at 0.16% (5th percentile), so this is a genuine but moderate-priority issue. Impact is confined to stored form-submission data - integrity and availability are rated Low, with no confidentiality loss and no compromise of the underlying WordPress host.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
Unauthenticated information disclosure in CodeAtoZ B2B Suite for WooCommerce before 1.6.1 allows remote attackers to retrieve other guests' submitted quotes, including buyer names, email addresses, and requested line items, by supplying an enumerable identifier. No authentication or user interaction is required, and publicly available exploit code exists, though the EPSS score is only 0.18% (7th percentile). This is a moderate-severity issue (CVSS 5.3) with impact limited to confidentiality of quote data, and no active exploitation has been confirmed (not in CISA KEV).
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Unauthenticated remote attackers can delete the stored SEO analysis data held by the Rank Math SEO WordPress plugin in any version before 1.0.280, because the routine that wipes that data enforces neither a capability check nor a nonce. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, 5.3) reflects an unauthenticated, network-reachable integrity-only impact: confidentiality and availability are untouched, so the realistic damage ceiling is loss of the plugin's cached SEO analysis results rather than site compromise or downtime. Publicly available exploit code exists and the vendor has shipped a fix, but CISA's SSVC evaluation rates exploitation as "none" and EPSS is only 0.17% (5th percentile), so this is a low-to-moderate priority issue and not confirmed actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
SQL injection in WooCommerce Polylang Integration plugin versions up to and including 1.5.0 allows authenticated attackers with Subscriber-level access to extract sensitive information from the WordPress database via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The flaw requires the plugin to be active and a low-privileged account, which is easily obtained on WooCommerce sites allowing customer registration. No public exploit code has been identified at time of analysis, and the impact is limited to data confidentiality.
Stored cross-site scripting in the Social Share Buttons & Analytics plugin - GetSocial.io for WordPress (all versions up to and including 4.5) lets an authenticated attacker with at least subscriber-level access save arbitrary JavaScript through the 'response' parameter into the gs-alert-msg, gs-alert-utm and gs-alert-cta options, which then executes in an administrator's browser when the GetSocial settings page is opened. Exploitation is constrained: the payload is not immediate and only fires on that specific wp-admin page, and the attacker must already hold a low-privileged account on the target site (for example through open registration). There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV; the assessment is that this is a genuinely moderate, not high-priority, issue.
Unauthenticated information disclosure in the Avada (Fusion) Builder WordPress plugin (all versions up to and including 3.16.1) lets remote attackers read arbitrary WordPress user meta - including administrator email addresses and login names, the wp_user_level field, and WooCommerce customer PII such as billing_email, billing_phone and billing_address_1 - for any user ID by supplying a crafted args[link_target] value. The one prerequisite is that the target site must render the [fusion_instagram] shortcode on some page, because the required awb-instagram-nonce is printed in plaintext inside fusionInstagramVars there and can be harvested by any anonymous visitor before the exploit request is sent; no authentication or user interaction is otherwise required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is greatest on WooCommerce-enabled sites where billing data lives in user meta, and no public exploit code was identified at time of analysis (not listed in CISA KEV); the flaw is a CWE-200 exposure whose practical priority is moderate given the low confidentiality-only impact and the shortcode precondition.
Stored cross-site scripting in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) affects all versions up to and including 8.10.2.1, letting an attacker with a subscriber-level account inject arbitrary JavaScript through the 'phone' listing field that then executes in the browser of any user viewing the affected listing page. The weakness is reachable because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role by default, so a subscriber can submit and publish a listing with no administrator moderation; the primary real-world prerequisite is therefore a site that allows open or self-service user registration. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as CVE-2026-100185 by Wordfence, this is a moderate-severity issue that sits below top-priority status, and at the time of analysis there is no public exploit identified and no CISA KEV confirmation of active exploitation, though the low privilege bar makes it more practical than its modest impact metrics suggest.
Stored cross-site scripting in the PO/MO Editor WordPress plugin, affecting all versions up to and including 1.4.2, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary script through the 'podata' parameter, which the plugin persists and later serves as a replacement .po/.mo translation file via its load_textdomain_mofile filter. Because the injected translation is rendered for any visitor loading an affected page, a low-privilege account on a site with open registration enabled is sufficient to seed persistent script execution in other users' browsers; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) reflects network reachability, no user interaction beyond page view, scope change, and limited confidentiality and integrity impact with no availability effect. Exploitation requires the plugin to be installed and active plus a valid low-privilege account, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Countdown Timer - Widget Countdown through version 3.0.1 allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages by supplying a malicious 'redirect_url' shortcode attribute. Because the payload is persisted, the script executes in the browser of any user - including administrators - who later views the injected page, yielding limited confidentiality and integrity impact within the affected site's origin (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is gated by the requirement for a contributor-or-higher account on a site running the plugin.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.
Arbitrary file deletion in the Database Addon for Contact Form 7 - CFDB7 WordPress plugin through version 1.4.1 allows unauthenticated attackers to inject a crafted multipart submission field whose name contains the substring 'cfdb7_file' and whose value is an arbitrary filesystem path; the plugin stores that non-form-tag field and later passes it to unlink() without basename()/realpath() normalisation or any check that the file belongs to that submission. Because deletion does not occur at submission time but only when an administrator bulk-deletes the poisoned entry from wp-admin, successful exploitation depends on privileged operator interaction, which is why the independent assessment rates it CVSS 5.3 (MEDIUM) with UI:R while retaining PR:N and network reachability. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Booking Package WordPress plugin (versions up to and including 1.7.29) allows authenticated users with contributor-level access or higher to inject persistent JavaScript via the 'id' parameter, which executes when other users view the injected page. The flaw results from insufficient input sanitization and output escaping, and no public exploit has been identified at time of analysis. Exploitation requires an authenticated contributor account, and the impact is constrained to higher-privileged users who access the malicious content, making this a moderate-severity issue.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
Premium Addons for Elementor, a WordPress plugin that extends the Elementor page builder, fails to enforce an authorization check on at least one of its functions in versions up to and including 4.11.110, allowing remote attackers to reach functionality or data that should be restricted. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable with no credentials and no user interaction required, so default installations are exposed, but the scored impact is confined to LOW confidentiality (C:L/I:N/A:N) - read access to limited information or a restricted action rather than site takeover. There is no CISA KEV entry and no publicly available exploit code identified at time of analysis, so this is a moderate-severity, low-priority issue best handled through routine plugin patch cycles.
ThemeGrill's User Registration WordPress plugin (versions up to and including 5.2.8) fails to enforce authorization checks on one of its endpoints, letting a low-privilege authenticated user perform actions that should be restricted. Exploitation requires a valid session (CVSS PR:L), but because the plugin's core purpose is open self-service registration, an attacker can typically create the necessary account themselves - no user interaction is needed and the attack is remote and low-complexity. Impact is limited to integrity and availability of the affected functionality (I:L/A:L, no confidentiality impact), rated CVSS 5.4; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in the WordPress 'Books Gallery' plugin (wp-books-gallery) affects all releases through 4.8.4, allowing an attacker to persist malicious JavaScript that executes in the browser of whoever later views the affected page. Per our assessment, exploitation requires an authenticated WordPress account with at least low-level posting privileges (CVSS vector PR:L) plus victim interaction (UI:R) - a privileged user or site visitor must load the page where the injected payload is rendered - so this is not remotely exploitable without credentials, and real-world risk is materially constrained by those prerequisites. Rated CVSS 6.5 by Patchstack and mapped to CWE-79, this is a moderate-severity issue with no public exploit identified at time of analysis and no CISA KEV listing; exposure is confined to WordPress sites running the Books Gallery plugin at version 4.8.4 or earlier.
WordPress sites running the ThemeGrill User Registration plugin through version 5.2.8 can be queried by unauthenticated remote attackers to retrieve embedded sensitive data, because a missing authorization check (CWE-862) leaves a data-exposing code path reachable without any privilege. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, and the impact is confined to Low confidentiality with no integrity or availability effect - the attacker gains read access to specific exposed data rather than full account or site compromise. Exploitation is limited to sites that have not upgraded past 5.2.8, and there is no public exploit identified at time of analysis and no confirmation of active exploitation (not listed in CISA KEV); this is a routine patch-management item rather than an emergency.
Stored cross-site scripting in the ThemeGrill User Registration WordPress plugin (versions through 5.2.8) lets an authenticated low-privilege user - realistically anyone who can complete the plugin's own self-service sign-up form when open registration is enabled - persist malicious script into plugin-stored data that later renders in a victim's browser. The payload only fires when a higher-privileged user, typically an administrator reviewing registrations or user records, loads the affected page, so exploitation requires that human view-step and is not automatable against an idle target; CVSS is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the flaw is scope-changing it can affect resources beyond the plugin's own security context.
Information disclosure in Active Products Tables for WooCommerce through version 2.1.3 lets unauthenticated remote visitors retrieve embedded sensitive data from rendered product tables. The issue is CWE-201 and is rated CVSS 5.3 with low confidentiality impact only, no integrity or availability impact; WordPress/WooCommerce sites running the affected plugin are exposed. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Cross-site request forgery (CSRF) in the ThemeGrill User Registration WordPress plugin through version 5.2.8 allows remote attackers to trick a logged-in privileged user into performing unintended actions, with low integrity and availability impact (CVSS 5.4). Exploitation requires an active authenticated WordPress session and successful social engineering to load attacker-controlled content (UI:R), as reflected in the CVSS vector (PR:N, UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates this as a moderate-severity, low-priority issue for most defenders.
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote attackers to reach plugin functionality that should require privileged access, tampering with data or settings within the plugin's scope. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N means it is exploitable over the network by unauthenticated attackers with no user interaction, but the consequence is confined to a partial integrity impact - no data disclosure and no availability loss. Severity is moderate (CVSS 5.3), and no public exploit identified at time of analysis; there is no CISA KEV listing for this CVE.
Missing access control checks in ThemeGrill's User Registration plugin for WordPress, versions through 5.2.8, let unauthenticated remote users (CVSS PR:N/UI:N) reach restricted functionality that should require higher privileges, resulting in low-impact disclosure of protected data (C:L, I:N, A:N). The issue is rated moderate at CVSS 5.3 and does not by itself enable account takeover, data modification, or code execution, so its practical value to an attacker is information gathering rather than full compromise. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the specific registration endpoint or feature that is improperly authorized is not named in the available data, so the exact exposure surface remains unscoped pending the vendor advisory.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Stored cross-site scripting (XSS) in the Prime Slider - Addons For Elementor WordPress plugin (bdthemes-prime-slider-lite) through version 4.7.1 lets an authenticated low-privileged user persist malicious script through slider/Elementor widget content, which then executes in the browser of any higher-privileged user who views the affected page (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored server-side and fires on page render, the practical impact is session/token theft, content injection, or privileged actions performed in the victim's context - though exploitation is not remote-unauthenticated and requires the victim to interact with the poisoned page. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-priority, not a drop-everything, issue.
Stored cross-site scripting in PowerPack Addons for Elementor through version 3.1.0 allows authenticated users who can create or edit PowerPack widget content to inject persistent JavaScript that executes when another user views the affected page. The independent assessment rates this as a moderate-priority issue rather than an urgent one: exploitation requires a lower-privileged authenticated WordPress account, typically contributor/author level, and a second user must load the tampered content (UI:R), with scope change but only low confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis, no CISA KEV entry, and no EPSS score was supplied in the provided data.
FluentBoards through version 2.1.0 contains a missing authorization flaw that allows an authenticated low-privilege WordPress user to perform actions outside their intended role, with limited confidentiality and integrity impact. The plugin must be installed and active, and the assessed CVSS vector requires PR:L, so this is not an unauthenticated bypass. No public exploit code or confirmed active exploitation was identified in the provided intelligence; the primary source is the Patchstack advisory.
Stored cross-site scripting in Premium Addons for Elementor (versions through 4.11.110) allows an authenticated low-privilege WordPress user to persist malicious JavaScript through plugin widget input, which then runs in the browser of any user who views the poisoned page. Exploitation requires a content-editing account such as contributor or author (PR:L) plus a victim loading the affected page (UI:R), so single-author and tightly locked-down sites have little exposure while multi-author sites or those with open registration granting posting roles are the primary targets. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS data was supplied with the available intelligence.
Missing authorization in the Amelia WordPress booking plugin (TMS Amelia) through version 2.4.10 allows unauthenticated remote attackers to tamper with restricted plugin actions due to insufficient access control checks. This medium-severity flaw (CVSS 5.3, CWE-862) carries only limited integrity impact (I:L) with no effect on confidentiality or availability, and no public exploit or active exploitation has been identified at time of analysis. Affected are WordPress sites running the plugin at version 2.4.10 or earlier; the issue requires no authentication, user interaction, or non-default configuration per the CVSS vector.
Missing authorization in the WordPress plugin WP User Manager (all versions through 2.9.23) allows remote attackers to reach plugin functionality that should be protected by access-control checks, disclosing limited information. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with confidentiality-only impact (C:L/I:N/A:N), exploitation requires no authentication and no user interaction against any site running the vulnerable plugin version, but the consequences are capped at low-severity information exposure. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base score of 5.3 and the Patchstack-reported broken access control classification, this is a moderate, low-priority finding that still warrants patching or virtual patching on internet-facing WordPress sites.
Missing authorization in the Pay for Payment for WooCommerce WordPress plugin (all versions through 3.0.1) allows unauthenticated remote attackers to reach functionality that should require an elevated capability, with impact limited to a low-integrity effect. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium), no authentication or user interaction is required, but no data disclosure or denial of service results; the site must have the plugin installed and active at version 3.0.1 or earlier and the vulnerable action must be network-reachable. No confirmed active exploitation and no public exploit code were identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureForms WordPress plugin (all versions through 2.12.7) allows an authenticated low-privileged user to inject script payloads through form fields that execute when a higher-privileged user, typically an administrator, later views the stored submission. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires an existing submission-capable account plus victim-driven user interaction, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An unauthenticated remote attacker can invoke access-controlled functionality in the Fullworks Plugins Quick Paypal Payments WordPress plugin (versions through 6.0.3) because the plugin does not enforce the authorization checks that gate those code paths. Successful exploitation yields a bounded Low integrity impact - an attacker can reach and manipulate plugin/payment-related data but cannot read confidential data or affect availability through this issue alone, which is why this is a moderate-risk, not high-priority, issue per our assessment. No public exploit code was identified at time of analysis and the plugin has no CISA KEV listing, but the endpoint is trivially reachable over the network with no credentials or user interaction required, and no vendor-released fixed version is confirmed in the available data.
Second-order SQL injection in the Animated Number Counters WordPress plugin (all versions up to and including 3.0) allows an authenticated user with editor-level capabilities or higher to plant a crafted 'counterid' value that is later concatenated unsanitized into SQL queries, enabling extraction of sensitive data from the WordPress database. Successful exploitation requires the attacker to first store the payload through the plugin's counter-save feature and then trigger the vulnerable read/render path, so the privilege requirement (PR:H) keeps realistic risk moderate rather than critical. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, although the vulnerability class and the appearance of an upstream code change in the plugin repository make prompt patching advisable for any site granting editor accounts to untrusted users.
Sensitive information exposure in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress lets any authenticated user at subscriber level or above pull diagnostic and environment data out of the site through the plugin's ai_wp_footer_hook code path, affecting all releases up to and including 2.8.18. The leaked material spans the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and every post meta value - including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the main constraint is the account requirement, so sites that allow open subscriber self-registration have a materially larger exposure surface than sites that restrict registration to trusted users.
Unauthenticated retrieval of embedded sensitive data is possible on WordPress sites running the WPGraphQL plugin through version 2.23.1, because the plugin omits an authorization check on the affected GraphQL operation (CWE-862). Any network-reachable instance exposes the flaw to unauthenticated requesters requiring no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3), with impact confined to low confidentiality loss and no integrity or availability effect. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the practical exposure is limited to sites that run the plugin and publish their GraphQL endpoint, and this is assessed as a genuine but moderate-priority issue rather than a top-tier emergency.
Unauthenticated arbitrary file upload in the WP-BusinessDirectory WordPress plugin (through version 4.0.2) allows remote attackers to write files with attacker-controlled content to attacker-chosen locations on the web server. Any default installation running the vulnerable plugin with the upload endpoint reachable is exposed without credentials or user interaction, but the plugin vendor notes that this arbitrary write does not translate into code execution on a default server configuration - achieving remote code execution requires a non-default or misconfigured server (for example, writable and executable web paths) or chaining with a second weakness. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); this is a moderate-severity integrity issue that warrants patching but is not a drop-everything emergency on the available signals.
Stored cross-site scripting in the WP Testimonials WordPress plugin (all versions through 1.4.13) lets an authenticated user holding the Author role or higher persist JavaScript inside testimonial content, which then executes in the browser of any user - including an administrator - who later views the rendered testimonials (assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The plugin not only fails to escape testimonial output but actively reverses WordPress's built-in HTML sanitization when rendering it, so the payload survives despite core protections, and exploitation needs no non-default settings. Impact is gated by the Author-level privilege requirement plus a victim subsequently loading the affected page, so single-author or single-admin sites with no untrusted accounts are materially less exposed; at time of analysis there is no CISA KEV entry and no public exploit code identified, and the flaw was reported to WPScan (tracked as EUVD-2026-98299).
Stored cross-site scripting in the Griden 'Responsive Slider' WordPress plugin (versions through 0.1.9) allows an authenticated user with at least low-level privileges to persist malicious JavaScript into slider content, which then executes in the browser of any visitor who renders the affected page. Because the payload is stored server-side and fires on victim page views, exploitation requires a victim to interact with the compromised slider (UI:R), while the attacker only needs rights sufficient to edit slider content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5). No public exploit code has been identified at time of analysis and the plugin is not reported as actively exploited (no CISA KEV listing); risk is elevated for multi-author or low-trust-administration WordPress sites where untrusted accounts can edit slider content.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the IMPress for IDX Broker WordPress plugin (versions through 3.3.1) allows an authenticated low-privilege user - such as a contributor or author who can submit data through an IMPress input field - to persist malicious JavaScript that executes in the browser of any other user, including an administrator, who later views the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects that exploitation is not unauthenticated: it requires a valid low-privilege account on the target site plus victim interaction, and it only applies where the plugin is installed and active. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); Patchstack is credited with the report.
Stored cross-site scripting in the Weaver Xtreme Theme Support WordPress plugin (all versions through 7.0.1) allows an authenticated user with only low-level posting privileges to persist malicious JavaScript that then executes in the browser of any user who loads the affected page, including administrators. Rated CVSS 3.1 6.5 (Medium) with a scope-change vector (S:C) and requiring victim interaction (UI:R), the flaw is a CWE-79 improper-neutralization issue reported by Patchstack. No public exploit code has been identified at time of analysis and no fixed version is confirmed in the available data, so exposure is greatest on multi-author installations that grant untrusted accounts content-creation rights. Note that per the CVSS vector (PR:L) this is not exploitable by unauthenticated remote attackers.
Missing authorization in the RocketGeek WP-Members WordPress plugin through version 3.5.7 permits authenticated low-privilege users-such as self-registered members-to bypass incorrectly configured access-control security levels, resulting in limited confidentiality and integrity impact. Rated CVSS 5.4 (CWE-862), the flaw requires a valid low-privilege account that is readily obtainable on sites with open registration, and its effect is amplified when membership security levels are misconfigured. No public exploit or active exploitation is identified in the provided intelligence.
Race condition in the Pixelite Events Manager WordPress plugin (versions through 7.4.7) lets a remote, unauthenticated attacker target a narrow synchronization window in the plugin's handling of a shared resource, resulting in a limited integrity impact with no confidentiality or availability effect. Exploitation hinges on winning a concurrency race - tightly-timed overlapping requests must land inside the vulnerable window (CVSS AC:H), a probabilistic timing requirement that substantially reduces reliability and keeps overall severity low. No public exploit has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated remote attackers can supply their own values for web parameters that the VillaTheme Salevo (woo-boost-sales) WordPress plugin treats as immutable, letting them tamper with the data the plugin accepts and acts on in versions up through 1.3.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 5.3) confirms the request path needs no authentication, no user interaction, and no non-default configuration, but the impact is capped at a partial integrity loss with no confidentiality or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority hardening item rather than an emergency patch, with real exposure confined to sites that actually run this specific plugin.
Stored cross-site scripting (XSS) in BdThemes Element Pack Elementor Addons versions up to and including 8.8.8 allows an authenticated attacker with low-level content-editing privileges to inject malicious scripts that execute in the browser of a higher-privileged user who views the affected page. This moderate-severity vulnerability (CVSS 6.5) requires victim interaction and is not exploitable without authentication; no public exploit code has been identified at time of analysis.
Missing authorization in the WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams, versions through 7.5.13) lets an attacker who already holds a low-privilege account on the site bypass the plugin's access-control checks and read information that should be restricted to higher-privileged users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) confirms it is remotely reachable, requires no user interaction, and is limited to a confidentiality disclosure of low severity, with no integrity or availability impact; the scope change (S:C) reflects that the weakness lets the attacker reach resources beyond the plugin component itself. Exploitation status is no public exploit identified at time of analysis - there is no KEV listing and no published proof-of-concept code - and the practical prerequisite is that the attacker must first register or otherwise obtain a low-privilege session on a site running the vulnerable version.
Missing authorization in the VideoWhisper Broadcast Live Video WordPress plugin (all versions through 7.3.6) allows an authenticated low-privilege user to invoke plugin functionality they are not entitled to and alter site content or plugin settings without holding the required capability. The impact is integrity-only (CVSS 4.3, C:N/I:L/A:N), scope is unchanged, and no confidentiality loss or denial of service results. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and the assessed exploitation conditions (a valid low-privileged account on a site with the plugin enabled) place real-world risk at low priority rather than urgent.
Stored cross-site scripting in the Premium Addons for Elementor WordPress plugin (through version 4.11.110) lets an authenticated user with low-level content-contribution privileges plant persistent JavaScript inside Elementor-built pages or widgets, which then executes in the browser of any user who renders that content. The CVSS 6.5 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity attack that requires an account with at least contributor/author-tier access and victim interaction, with the changed-scope (S:C) metric indicating the injected script acts in the context of the site origin rather than a confined component. Only sites running the plugin at or below 4.11.110 are affected, and no public exploit code or CISA KEV entry was identified at time of analysis.
This moderate-severity DOM-based cross-site scripting issue affects the ExpressTech Quiz And Survey Master WordPress plugin through version 11.2.7. An authenticated attacker with at least low-level privileges can supply input that is later rendered into a client-side DOM sink, causing script execution in the browser of a victim who interacts with the affected quiz or survey page. The CVSS 3.1 score is 6.5 (Medium); no public exploit was identified at time of analysis, and exploitation requires victim interaction.
Missing authorization in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.58.0) allows unauthenticated remote attackers to reach functionality that should be gated by an access-control check, resulting in low-impact but unauthenticated disclosure of site data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates no credentials, no user interaction and no special complexity are needed against an affected installation, though the impact is confined to confidentiality (no integrity or availability loss). No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data, so the practical risk is medium and primarily affects sites still running 1.58.0 or earlier.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Stored cross-site scripting in the Ad Inserter WordPress plugin (all versions through 2.8.18) allows an authenticated low-privilege user - a contributor, author, or any role permitted to create or edit ad blocks - to persist malicious script into plugin ad configuration, which then executes in the browser of another user, typically an administrator, when that page or the plugin's settings screen is rendered. Successful exploitation is bounded by two prerequisites: the attacker must already hold a suitably privileged WordPress account, and a second user must view the poisoned content, so this is not remotely exploitable against a default install by an anonymous visitor. Independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5, moderate), and no public exploit identified at time of analysis; EPSS data was not supplied, so no exploitation-probability estimate can be cited.
Stored cross-site scripting in Crocoblock JetMenu (a WordPress mega-menu builder plugin) through version 3.0.5 lets an authenticated user with low-level content-authoring privileges inject script that is persisted and later executed in the browser of a higher-privileged viewer such as an administrator or editor. The flaw is rated CVSS 6.5 (Medium) under CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for a valid account (PR:L) and for a victim to render the poisoned menu content (UI:R), with scope change because the injected script runs in the victim's session context. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); risk is concentrated on sites that grant untrusted or low-privilege users menu/content authoring capabilities.
Stored cross-site scripting in Crocoblock's JetElements For Elementor WordPress plugin (all versions through 2.9.2.3) allows an attacker holding a low-privilege account on the target site to persist malicious script through a JetElements input field, which then executes in the browser of any user who views the affected page. The vulnerable path requires an authenticated user with at least contributor/author-level posting capability and depends on a victim later visiting the poisoned content; successful exploitation runs script under the site's own origin, enabling session or credential theft and content/administrative action injection against higher-privileged viewers. There is no public exploit identified at time of analysis and no confirmed active exploitation; the issue is rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) and no patched version is specified in the available advisory data.
Missing authorization checks in the WP User Manager plugin for WordPress (versions through 2.9.22) let an authenticated low-privileged user invoke plugin functionality that should be restricted to higher-privileged roles, resulting in unauthorized integrity changes rather than data disclosure or disruption. The flaw is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning remote exploitation is possible but requires a valid low-privileged account (PR:L) and only affects integrity (C:N/A:N); because the plugin provides front-end registration and profile management, such accounts are frequently self-obtainable on sites with open registration enabled, which materially raises practical reach even though fully anonymous attackers cannot exploit it. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so this is best treated as a modest-priority, high-volume WordPress plugin hardening issue rather than an urgent emergency.
Missing authorization in the WP Desk Flexible Subscriptions WordPress plugin, affecting all versions through 1.8.4, lets an authenticated low-privilege user (for example a registered customer or subscriber, PR:L) invoke plugin functionality that lacks a proper capability check, altering data the account should not be able to change. Impact is limited to partial integrity loss - no confidentiality or availability effect and no scope change - giving it a moderate CVSS 3.1 base score of 4.3, and exploitation requires a valid session on the target WordPress/WooCommerce site. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, not a priority, issue.
Missing authorization in the Codection 'Products Restricted Users for WooCommerce' WordPress plugin, version 0.7 and earlier, allows unauthenticated remote attackers to bypass the plugin's access-control logic and alter which products are restricted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required against a default installation, although the impact is limited to low integrity (C:N/I:L/A:N) on plugin-controlled restriction state rather than data disclosure or denial of service. No public exploit code was identified at time of analysis, and the plugin has a narrow deployment footprint, so this is a moderate rather than high priority finding.
Stored cross-site scripting in the WordPress plugin Custom Query Blocks through version 5.6.0 lets an authenticated low-privilege user (for example a contributor or author) inject script that executes in the browser of any other user who later views the affected page, including administrators. The plugin fails to neutralize stored input before rendering it during web page generation (CWE-79), and exploitation requires both valid account credentials and a victim who loads the injected content, so the attack is not fully automatable. With a CVSS base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), impact is scoped to the victim's session and page context, and no public exploit code has been identified at time of analysis.
Low-privilege authenticated users can bypass access-control checks in the WordPress 'Event post' plugin (versions from initial release through 6.1.1), allowing them to perform event-management actions and read or modify event data they are not authorized to touch. The flaw is a CWE-862 missing authorization issue scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires an existing account on the target site at subscriber/contributor-level privilege or higher - unauthenticated visitors cannot trigger it directly, though self-registration or any low-privilege account lowers the bar. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; impact is limited to partial confidentiality and integrity of event data with no availability effect.
Authenticated users with only low privileges (for example a WordPress subscriber or registered WooCommerce customer) can reach at least one TMDS dropshipping plugin action that performs no authorization check, allowing them to make unauthorized state changes against a WordPress site running TMDS 1.0.15 or earlier. The vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects limited integrity and availability impact with no confidentiality loss, and exploitation requires a valid low-privilege account, so the practical risk is moderate rather than critical. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied; only a Patchstack advisory (credited as the reporting source) documents the issue.
Missing authorization in the WordPress plugin VideoWhisper Site Manager for ChatGPT, Claude, Codex (all versions through 1.2.10) lets an authenticated low-privilege site user reach plugin functionality that should require higher capabilities, resulting in limited confidentiality and integrity impact at CVSS 5.4. The flaw is a broken access control condition (CWE-862) requiring only a valid WordPress account on a site with the plugin active (PR:L), remote reachability and low attack complexity with no user interaction; availability is unaffected. No public exploit code was identified at time of analysis, and this does not by itself permit full site takeover or denial of service.
Authenticated users of a WordPress site running the Paid Videochat Turnkey Site plugin (ppv-live-webcams) through version 7.5.12 can manipulate quantity/specified-value input parameters because the plugin fails to properly validate them (CWE-1284). Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable but demands a logged-in account and yields only limited integrity impact, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-severity, low-priority hardening item rather than an urgent threat.
Authorization bypass through a user-controlled key in the WordPress 'Event Post' plugin (NOUS Ouvert Utile et Simple), affecting all versions through 6.1.1, allows an authenticated low-privilege user to reference and manipulate event objects belonging to other users by supplying a crafted identifier. The flaw is a classic IDOR (CWE-639) caused by an incorrectly configured access-control check, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity impact only, with no confidentiality or availability loss and no user interaction required. The primary precondition is that the attacker holds any authenticated account on the target site, so exposure is greatest on sites that permit open or untrusted user registration; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fixed version appears in the available advisory data.
Input data manipulation in WP Desk Flexible Quantity - Measurement Price Calculator for WooCommerce through 2.3.22 lets unauthenticated remote attackers alter submitted quantity or measurement values because the plugin does not properly validate those inputs (CWE-1284). The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so impact is limited to integrity of pricing/quantity calculations, with no read, denial-of-service, or code-execution impact. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the provided data.
Insecure direct object reference in the Hotel Booking WordPress plugin (versions through 3.8) lets any authenticated user - a Subscriber-level account is sufficient - retrieve booking records that belong to other customers by supplying a booking identifier they do not own. Because the plugin performs no ownership check on the requested record, an attacker can harvest customer PII including names, email addresses, phone numbers, and postal addresses; the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms a network-reachable, low-privilege, read-only confidentiality impact with no integrity or availability effect. The issue is significantly easier to reach on sites that allow public user self-registration, which is common for hospitality bookings; no public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is a genuine but moderate-priority authorization defect rather than an emergency.
Cross-site request forgery in the Hotel Booking WordPress plugin (versions through 3.8) lets an attacker forge administrative requests that create, delete, or modify booking order records inside an administrator's authenticated browser session, yielding a limited integrity-only impact (CVSS 4.3, C:N/I:L/A:N). The attacker needs no account of their own (PR:N), but the attack only succeeds if a logged-in administrator is tricked into loading an attacker-controlled page or hidden auto-submitting form (UI:R), which is the primary limiting factor. No public exploit code has been identified at time of analysis, and confidentiality and availability are not affected - only the accuracy of booking order data is at risk.
Authenticated users holding only subscriber-level privileges can permanently delete every comment on a WordPress site running the WP Comment Cleaner plugin in versions 6.1 up to (but not including) 7.2, because one of its bulk comment-deletion routines performs no capability check and no nonce validation (CWE-862). Scored CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the flaw is a moderate-priority access-control weakness confined to destruction of comment data, with no confidentiality or service-availability impact, rather than a code-execution emergency. No public exploit identified at time of analysis, but practical exploitation is easiest on sites that allow self-service registration, since that lets any attacker obtain the minimal account required; sites that disable open registration and tightly control accounts substantially shrink the attacker population.
Stored cross-site scripting in the HireZoot WordPress plugin before version 4.0.0 lets an authenticated user who holds the plugin's management capability (Administrator by default) store a script payload in a job specification setting that is later rendered without escaping in an admin-area settings page and executes in the browser of any administrator who opens that page. Because the payload runs inside the viewing administrator's session, any impact is bounded by that administrator's own privileges, and the flaw is only a meaningful privilege escalation where administrators lack the unfiltered_html capability - WordPress multisite installs or sites with DISALLOW_UNFILTERED_HTML defined - since on default single-site installations administrators can already inject unfiltered HTML. This is a low-priority, network-reachable issue (CVSS 3.5, PR:H, UI:R) and no public exploit was identified at time of analysis; the vendor has shipped a fix in version 4.0.0.
Symlink following in the nginx third-party module ngx_cache_purge before 3.0.4 allows a local attacker to cause deletion of files outside the configured proxy_cache_path: the module's purge walks (purge_all, wildcard purge, or a plain proxy_cache_purge PURGE request) trust nginx's ngx_walk_tree(), which classifies directory entries with stat() and therefore descends into planted symlinks. Exploitation is narrow - it requires that nginx and a served application such as WordPress run under the same OS user account and that the attacker already has that user's file-write or code-execution capability to plant the link - and no public exploit code or confirmed in-the-wild activity was identified at time of analysis, with the assessed CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) reflecting a genuinely low-priority, local-only, high-complexity issue. Version 3.0.4 blocks symlinks found inside the cache tree but does not close an applicable TOCTOU race condition, so the shared-user deployment remains the decisive risk factor.
Information disclosure in the WP-Invoice WordPress plugin through version 4.3.1 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email addresses, display names and profile details of every registered user on the site by invoking AJAX handlers that perform no capability checks. The issue is network-exploitable with low attack complexity (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires only a valid logged-in account, which an attacker can often self-provision when public user registration is enabled. Publicly available exploit code exists, but CISA's SSVC assessment records no known exploitation at time of analysis, and no KEV listing applies. Because the leaked roster of names and emails is directly reusable for phishing and credential-targeting, the practical risk is moderate for sites with open registration and low for closed-membership deployments.
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.
SQL injection in the paymendo WordPress plugin (all versions through 1.1) lets an authenticated user with only low privileges inject arbitrary SQL through a request parameter that is not sanitized or escaped before being placed into a query, exposing database contents to read-out. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability, no user interaction, and a high confidentiality impact with no integrity or availability effect, and publicly available exploit code exists. The authentication requirement is the key limiting factor: on sites that allow self-service registration, a subscriber account is all that is needed, while closed-registration sites require the attacker to already hold valid credentials.
Blind SQL injection in the paymendo WordPress plugin through version 1.1 allows unauthenticated remote attackers to extract sensitive data from the underlying database via an unsanitized parameter. Publicly available exploit code exists, though no CISA KEV listing indicates active exploitation at time of analysis; no EPSS score was provided. The vulnerability is rated medium severity (CVSS 6.5) and affects any WordPress site with the vulnerable plugin active.
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL query string when the optional auto-login-after-registration feature is enabled, leaving the credential exposed in browser history and in web server, reverse-proxy, and CDN access logs (fixed in 4.8.3). Publicly available exploit code exists, but the exposure is strictly conditional: the vulnerable feature is not on by default, and an attacker must already have local access to the registrant's browser profile or privileged read access to the log stores named in the advisory. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms some level of local or privileged access is required and that only confidentiality is impacted, making this a genuine-but-low-priority information-disclosure issue rather than an urgent remote flaw.