WordPress
Monthly
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
Stored cross-site scripting (XSS) in the WP Meteor Website Speed Optimization Addon for WordPress (versions up to and including 3.4.18) lets unauthenticated attackers inject arbitrary JavaScript through the comment author name field, which executes in any user's browser when the affected page is viewed. The CVSS 3.1 score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity, unauthenticated attack that changes scope through client-side execution. The primary practical limitation is that the malicious comment must pass WordPress's comment moderation queue and be approved before the author name is rendered-a display prerequisite that reduces reliability, though sites that auto-approve comments or attackers with existing approved-commenter access bypass it. No public exploit code and no CISA KEV listing were identified at time of analysis.
Unauthenticated stored cross-site scripting in the 10Web Booster website speed optimization plugin for WordPress (slug tenweb-speed-optimizer) affects all versions up to and including 2.34.8, allowing remote attackers to plant malicious JavaScript through the comment 'author' (Name) field that executes in the browser of any visitor - including logged-in administrators - who loads a page containing the injected image markup. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C (7.2) confirms the issue is network-reachable, low-complexity and requires no authentication, and its scope change reflects that the injected script runs in a different security context than the vulnerable plugin component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world exploitation is further constrained because comments and author-name rendering must be enabled, comment moderation or spam filtering can block the payload before publication, and the script only fires once a victim actually loads the tainted page.
Stored cross-site scripting in the WordPress plugin LazyLoad Plugin - Lazy Load Images, Videos, and Iframes (rocket-lazy-load) through version 2.4.0 allows unauthenticated commenters to embed a crafted payload in a comment body that survives WordPress's wp_kses_data sanitization and only becomes an executable event handler when the plugin's render-time markup rewriting runs. Any visitor who subsequently loads the affected page can have arbitrary JavaScript executed in their browser, though exploitation is partly constrained because a site administrator must approve the crafted comment before it is rendered to others. There is no confirmed active exploitation (no CISA KEV) and no public exploit code identified at time of analysis; the CVSS 3.1 base score is 7.2 and our assessment adjusts the user-interaction metric to Required (UI:R) to reflect the moderation approval step. The vendor has released a fixed version (2.4.1).
Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Stored DOM-based cross-site scripting in the WordPress plugin Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker, in all versions up to and including 11.2.6, allows unauthenticated attackers to plant arbitrary JavaScript in the site's quiz submission and audit-trail data through the 'qsm_hidden_questions' parameter, which is stored without adequate sanitization and later rendered without output escaping. The injection is conditional: the attacker must deliberately break the 'mlw_results' INSERT by submitting an over-length or duplicate 'qsm_unique_key' value so that the plugin falls into the audit-trail branch that writes the raw payload into wp_mlw_qm_audit_trail.form_data, and the script only fires when a user - most plausibly an administrator reviewing quiz results or audit data - later loads the affected page. There is confirmed unauthenticated remote reachability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) with low confidentiality and integrity impact, but no public exploit code identified at time of analysis and no CISA KEV listing, so this is a conditional, moderate-priority fix rather than an emergency patch.
Account takeover in the SMS Alert WordPress plugin before 4.0.1 lets unauthenticated remote attackers set a new password on an arbitrary account - including an administrator - by completing the plugin's OTP password-reset flow with a phone number they control. Rated 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no authentication and no victim interaction, but is only reachable where the plugin's SMS/OTP password-reset feature is enabled and the attacker knows or can guess a valid target account identifier, which is why attack complexity is assessed as high. No public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in version 4.0.1.
Unauthenticated authentication bypass in the SMS Alert WordPress plugin before 4.0.1 lets an attacker log in as any user who has a phone number stored in their profile - including an administrator - by completing an SMS one-time-code challenge on a phone the attacker controls. The plugin validates the code itself but never verifies that the verified code belongs to the account being logged into, so the OTP check can be satisfied for one phone while the resulting session is issued for a different, targeted account. This is a high-severity (CVSS 8.1, CWE-287) issue, but exploitation is constrained: the SMS/OTP login path must be enabled and the target account must have a stored phone number, and no public exploit or confirmed active exploitation has been identified at time of analysis; the vendor has released a fix in 4.0.1.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
Stored cross-site scripting (XSS) in the LTL Freight Quotes WordPress plugin before 4.2.19 enables unauthenticated attackers to inject malicious JavaScript that executes in an administrator's browser session when the admin views the affected administrative page. The flaw arises because values submitted through an unauthenticated endpoint are neither sanitized nor escaped before being stored and later rendered. Although the vendor-assigned CVSS score is 8.8, our independent assessment classifies this as a scope-changing XSS with limited confidentiality and integrity impact (C:L/I:L/A:N) and requiring administrator interaction (UI:R). No public exploit code or active exploitation has been identified, and the vendor has released a patched version (4.2.19).
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Unauthenticated remote attackers can plant stored cross-site scripting payloads in the Podlove Podcast Publisher plugin for WordPress (all versions up to and including 4.5.6) by sending a POST to the Auphonic webhook endpoint with any status_string value other than the literal string 'Done'; the handler writes the entire raw $_POST superglobal into the plugin log before it ever validates the webhook authkey. The injected script only executes later, when a logged-in administrator opens the plugin's logging/Support page in wp-admin, so successful exploitation is conditional on an admin viewing the poisoned log entry - impact is confined to that administrator's authenticated browser session and is low for confidentiality and integrity with no availability impact. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the vendor has shipped an upstream code fix, though an explicitly tagged patched release version is not independently confirmed.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Privilege escalation in the Groundhogg CRM, Newsletters & Marketing Automation plugin for WordPress (all versions through 4.8.3) lets an attacker-controlled account whose user_login is exactly 'groundhogg' and whose user_email matches one of the hardcoded support addresses be silently promoted to administrator when a legitimate admin invokes the plugin's support-access feature. Exploitation is a deliberate two-actor sequence: the attacker must first plant or self-register the matching account (possible when open registration or any other self-service account-creation path exists), after which an admin triggering the submit_ticket or process_send_support_access entry points causes create_support_user() to adopt and promote that account; on multisite the promotion reaches super admin level when the triggering administrator holds manage_network_options, resulting in full site takeover. No public exploit code and no confirmed actively exploited (CISA KEV) status were identified at time of analysis, and the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R reflects both the low-privileged account the attacker must first obtain and the administrative interaction the flaw depends on.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.
Unauthenticated attackers can store arbitrary JavaScript in the WordPress 'Real Estate Manager - Property Listing and Agent Management' plugin (all versions up to and including 7.3) by submitting a crafted 'first_name' value through the public agent registration form, with the payload executing when an administrator later opens the Agents admin page where the value is rendered unescaped. The plugin's reCAPTCHA control provides no practical barrier because validation only runs when the g-recaptcha-response parameter is present, so simply omitting that parameter bypasses the check entirely. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, but the requirement for a privileged user to view the injected page keeps this a moderate-priority rather than emergency issue; version 7.4 fixes it.
Privilege escalation in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.9) lets any authenticated user holding the default sales_rep role - which carries edit_contacts, view_notes, and add_notes but not edit_users or promote_users - take over an administrator account. The vulnerable process_edit() handler in the contacts admin page accepts an attacker-supplied 'user' parameter without an ownership or capability check, so a contact can be relinked to an administrator's WordPress user ID; generating a note containing the {auto_login_link} replacement tag then produces a valid permissions-key auto-login URL for that contact, which the attacker reads back through view_notes and visits to authenticate as the administrator. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), and the flaw requires an existing low-privileged account rather than anonymous access; no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated attackers can delete a limited set of files on WordPress sites running the rtMedia for WordPress, BuddyPress and bbPress plugin through version 4.7.13, because the upload processing routine performs insufficient file path validation and the plugin treats a publicly exposed nonce as an authorization gate. The rtmedia_upload_nonce that guards the deletion path is emitted into frontend JavaScript by any page rendering the rtMedia gallery or upload shortcode, so it can be harvested by any anonymous visitor, although the impact is deliberately limited to files the plugin classifies as 'safe' rather than critical system or configuration files. Affected sites on 4.7.14 or later are not exploitable; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. The assessing vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting limited integrity and availability loss rather than the higher confidentiality weighting in the originally published CVSS score.
Unauthenticated attackers can trigger arbitrary WordPress action hooks on sites running the Avada (Fusion) Builder plugin up to and including 7.16.1, because the plugin dispatches a hook whose name is taken directly from an attacker-supplied form-field value without verifying authorization. The demonstrated impact is permanent destruction of site content - a crafted request deleted trashed posts, pages, and comments via the core wp_scheduled_delete action - with denial of service (e.g. wp_maybe_auto_update) and, where additional vulnerable third-party hook handlers are installed, further privileged writes; a blind arbitrary user/post-meta read also exists but its results are delivered only to the site owner and are not attacker-exfiltrable. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), this is a genuine high-priority issue rather than an inflated score, though it is not confirmed actively exploited and no public exploit code has been identified at time of analysis. The vendor addressed it in Avada 7.16.2.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
PHP Object Injection in the Quiz And Survey Master plugin for WordPress (versions up to 11.2.7) allows an authenticated attacker with low privileges to execute arbitrary code or manipulate files via crafted serialized input. The vulnerability is network-reachable with low complexity and no user interaction, and can lead to full site compromise if a suitable gadget chain is present. No public exploit code has been identified at the time of analysis.
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.
PHP object injection in the WordPress plugin Product Configurator for WooCommerce through version 1.7.5 allows an authenticated, high-privileged user (typically an administrator or shop manager) to supply crafted serialized data that the plugin passes to unserialize(), potentially enabling object injection and, if a suitable POP gadget chain exists in the plugin, WooCommerce, or WordPress core, arbitrary code execution or similarly severe impact. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires an active WooCommerce installation; no public exploit code or gadget chain is documented and no confirmed vendor-released fix version appears in the provided references, so no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the AcyMailing SMTP Newsletter WordPress plugin, versions through 11.1.0, allows unauthenticated remote attackers to inject malicious script into a generated web page that executes in a victim's browser when they are tricked into following a crafted link (CVSS 7.1, PR:N, UI:R). Because the payload is reflected and not stored server-side, exploitation hinges on luring a user - ideally an authenticated WordPress administrator - into triggering the request; no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a moderate-severity flaw (CWE-79) reported by Patchstack, with the specific vulnerable parameter or feature not named in the available description.
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Reflected cross-site scripting in the Heateor Support 'Sassy Social Share' WordPress plugin, affecting versions up to and including 3.3.79, lets an unauthenticated attacker inject script that executes in a victim's browser when the victim follows a crafted link or request and interacts with the page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the payload is reflected rather than stored, it does not persist on the site and each successful attack is per-victim, with impact limited to what the victim's session can reach - highest when the victim is a logged-in administrator. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied; the issue was reported by Patchstack, whose advisory should be consulted to confirm the exact vulnerable parameter.
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.
Reflected cross-site scripting in the Basix NEX-Forms WordPress plugin (through version 9.3.1) allows remote attackers to inject script into a page that executes in a victim's browser when that victim opens a crafted link, with user interaction required per the CVSS vector (UI:R) and no authentication required to trigger the flaw (PR:N). Successful exploitation can lead to theft of session cookies or authentication tokens and, because the vulnerable component scores S:C, the resulting script runs in the security context of the affected WordPress site - making a lured privileged administrator a particularly valuable target. The consequences are limited in scope: the payload is not stored and only affects users who follow the attacker's specific link, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated path traversal in ZealousWeb's Generate PDF using Contact Form 7 WordPress plugin, affecting all releases through 4.2.1, lets a remote attacker read arbitrary files from the web server, an impact mirrored by the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N - confidentiality only, no integrity or availability impact). Any WordPress site with this add-on installed, active, and reachable is exposed if its PDF generation/download endpoint accepts unauthenticated requests; the practical limiting factor is the plugin's comparatively small install base rather than any authentication or configuration barrier. At time of analysis no public exploit code has been identified and there is no CISA KEV listing, but the low-complexity, unauthenticated nature of the flaw makes it a natural candidate for automated mass scanning.
Reflected cross-site scripting in the 'Simple Payment' WordPress plugin (yalla ya!, versions through 2.5.4) lets an unauthenticated remote attacker inject script into a page generated by the plugin, which then executes in the browser of any user who clicks an attacker-crafted link while the plugin is active. Because the payload is reflected rather than stored, every victim must be individually social-engineered into following a malicious URL, and the resulting impact is limited to what is accessible within that victim's browser session (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the flaw has not been reported as confirmed actively exploited (CISA KEV), so the practical near-term risk is opportunistic rather than mass-exploitation driven.
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.
Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Reflected cross-site scripting (XSS) in the UpSolution Core (us-core) WordPress plugin through version 8.44 allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session when they click a crafted link, enabling session theft or page defacement. Exploitation requires the plugin to be active and the victim to interact with the malicious URL (UI:R); no public exploit code is identified at time of analysis. The independent assessment rates this as medium severity (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability impact.
Reflected cross-site scripting (CWE-79) in the Welcart e-Commerce WordPress plugin (usc-e-shop) affects all versions up to and including 2.12.3, allowing a remote unauthenticated attacker to inject script that executes in a victim's browser session. Exploitation depends on user interaction (UI:R): an attacker must lure a user - realistically a logged-in WordPress administrator or shop operator - into clicking a crafted link or visiting a page that reflects the malicious parameter, at which point the injected script can act with that user's privileges and, per the CVSS scope change (S:C), potentially affect resources beyond the vulnerable component. The vulnerability carries a CVSS 3.1 base score of 7.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patched version was confirmed from the available data.
Attackers can forge state-changing requests in the Featured Image from URL WordPress plugin through 6.0.7, allowing them to cause an authenticated administrator to perform unintended actions, but only if the administrator interacts with attacker-controlled content (UI:R). The input CVSS of 8.8 overstates impact; independent assessment rates confidentiality and integrity as Low and availability as None. No public exploit code identified at time of analysis; consult the Patchstack advisory for remediation.
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.
Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.
Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Reflected cross-site scripting in the ShopBuilder - Elementor WooCommerce Builder Addons plugin for WordPress (versions through 3.4.1) lets a remote attacker inject arbitrary script into a page the plugin generates from unvalidated input, so the payload executes in the browser of any user who opens a crafted link. No authentication is required of the attacker (CVSS PR:N), but exploitation depends on victim interaction with an active session (CVSS UI:R), and the impact is greatest when the lured target is a logged-in store administrator because the script then runs inside the WordPress dashboard. The risk is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) by independent assessment; no public exploit identified at time of analysis, and no vendor-released patch version is specified in the available intelligence, so the Patchstack advisory should be monitored for a fixed release.
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
PHP Object Injection in YITH WooCommerce Affiliates through version 3.31.0 allows an authenticated attacker who already holds a high-privilege WordPress account to deserialize untrusted input and potentially achieve code execution or otherwise tamper with the site, with high impact to confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable without user interaction, but the PR:H requirement is the key limiter: unprivileged or unauthenticated users cannot reach the vulnerable deserialization path. No public exploit identified at time of analysis and no EPSS score was provided; the primary mitigations are reducing high-privilege accounts and applying a vendor fix once one ships.
Stored cross-site scripting (XSS) in the WP Meteor Website Speed Optimization Addon for WordPress (versions up to and including 3.4.18) lets unauthenticated attackers inject arbitrary JavaScript through the comment author name field, which executes in any user's browser when the affected page is viewed. The CVSS 3.1 score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity, unauthenticated attack that changes scope through client-side execution. The primary practical limitation is that the malicious comment must pass WordPress's comment moderation queue and be approved before the author name is rendered-a display prerequisite that reduces reliability, though sites that auto-approve comments or attackers with existing approved-commenter access bypass it. No public exploit code and no CISA KEV listing were identified at time of analysis.
Unauthenticated stored cross-site scripting in the 10Web Booster website speed optimization plugin for WordPress (slug tenweb-speed-optimizer) affects all versions up to and including 2.34.8, allowing remote attackers to plant malicious JavaScript through the comment 'author' (Name) field that executes in the browser of any visitor - including logged-in administrators - who loads a page containing the injected image markup. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C (7.2) confirms the issue is network-reachable, low-complexity and requires no authentication, and its scope change reflects that the injected script runs in a different security context than the vulnerable plugin component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world exploitation is further constrained because comments and author-name rendering must be enabled, comment moderation or spam filtering can block the payload before publication, and the script only fires once a victim actually loads the tainted page.
Stored cross-site scripting in the WordPress plugin LazyLoad Plugin - Lazy Load Images, Videos, and Iframes (rocket-lazy-load) through version 2.4.0 allows unauthenticated commenters to embed a crafted payload in a comment body that survives WordPress's wp_kses_data sanitization and only becomes an executable event handler when the plugin's render-time markup rewriting runs. Any visitor who subsequently loads the affected page can have arbitrary JavaScript executed in their browser, though exploitation is partly constrained because a site administrator must approve the crafted comment before it is rendered to others. There is no confirmed active exploitation (no CISA KEV) and no public exploit code identified at time of analysis; the CVSS 3.1 base score is 7.2 and our assessment adjusts the user-interaction metric to Required (UI:R) to reflect the moderation approval step. The vendor has released a fixed version (2.4.1).
Stored DOM-based cross-site scripting in the VillaTheme Photo Reviews for WooCommerce plugin through version 1.2.30 lets unauthenticated visitors inject arbitrary web scripts into review-related comment meta, which execute when a shopper or admin later loads a product page displaying the affected review. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, and the only gate is the publicly emitted `wcpr_image_upload` nonce, so no authentication, capability, or attachment-ownership check is required. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Authorization bypass in the JoomUnited WP File Download plugin for WordPress (all versions up to and including 6.3.9) allows any authenticated user with subscriber-level access or above to permanently delete any file managed by the plugin, empty the entire trash, move files between categories, and publish or unpublish arbitrary files. The flaw is a missing authorization check (CWE-862), meaning the plugin's action handlers never verify that the caller holds a capability appropriate for the requested operation, so the lowest-privilege WordPress role is sufficient. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the barrier to exploitation is low because subscriber accounts are frequently obtainable through open self-registration; the assessed CVSS 3.1 base score is 8.1 (High) with high integrity and availability impact and no confidentiality impact.
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin lets unauthenticated attackers submit a crafted 'attachments[name]' value through the plugin's chat/messaging feature, which is then stored and executed in the browser of anyone who later views the injected page - typically a hotel operator or administrator reviewing chat attachments. Affected versions are all releases up to and including 1.8.15, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and reported by Wordfence; no public exploit identified at time of analysis, and the practical trigger is victim page access rather than the injection itself.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Stored DOM-based cross-site scripting in the WordPress plugin Quiz and Survey Master (QSM) - Quiz Maker & Survey Maker, in all versions up to and including 11.2.6, allows unauthenticated attackers to plant arbitrary JavaScript in the site's quiz submission and audit-trail data through the 'qsm_hidden_questions' parameter, which is stored without adequate sanitization and later rendered without output escaping. The injection is conditional: the attacker must deliberately break the 'mlw_results' INSERT by submitting an over-length or duplicate 'qsm_unique_key' value so that the plugin falls into the audit-trail branch that writes the raw payload into wp_mlw_qm_audit_trail.form_data, and the script only fires when a user - most plausibly an administrator reviewing quiz results or audit data - later loads the affected page. There is confirmed unauthenticated remote reachability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C) with low confidentiality and integrity impact, but no public exploit code identified at time of analysis and no CISA KEV listing, so this is a conditional, moderate-priority fix rather than an emergency patch.
Account takeover in the SMS Alert WordPress plugin before 4.0.1 lets unauthenticated remote attackers set a new password on an arbitrary account - including an administrator - by completing the plugin's OTP password-reset flow with a phone number they control. Rated 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no authentication and no victim interaction, but is only reachable where the plugin's SMS/OTP password-reset feature is enabled and the attacker knows or can guess a valid target account identifier, which is why attack complexity is assessed as high. No public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in version 4.0.1.
Unauthenticated authentication bypass in the SMS Alert WordPress plugin before 4.0.1 lets an attacker log in as any user who has a phone number stored in their profile - including an administrator - by completing an SMS one-time-code challenge on a phone the attacker controls. The plugin validates the code itself but never verifies that the verified code belongs to the account being logged into, so the OTP check can be satisfied for one phone while the resulting session is issued for a different, targeted account. This is a high-severity (CVSS 8.1, CWE-287) issue, but exploitation is constrained: the SMS/OTP login path must be enabled and the target account must have a stored phone number, and no public exploit or confirmed active exploitation has been identified at time of analysis; the vendor has released a fix in 4.0.1.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
Stored cross-site scripting (XSS) in the LTL Freight Quotes WordPress plugin before 4.2.19 enables unauthenticated attackers to inject malicious JavaScript that executes in an administrator's browser session when the admin views the affected administrative page. The flaw arises because values submitted through an unauthenticated endpoint are neither sanitized nor escaped before being stored and later rendered. Although the vendor-assigned CVSS score is 8.8, our independent assessment classifies this as a scope-changing XSS with limited confidentiality and integrity impact (C:L/I:L/A:N) and requiring administrator interaction (UI:R). No public exploit code or active exploitation has been identified, and the vendor has released a patched version (4.2.19).
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
Stored cross-site scripting in the Easy Digital Downloads WordPress plugin (all versions up to and including 3.6.9) allows unauthenticated attackers to inject arbitrary scripts through PayPal IPN parameters, which are stored without sanitization and later rendered unescaped in the wp-admin 'Gateway Error Logs' reporting table. Although the injection is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, with scope change because the script executes in the privileged wp-admin origin), the payload only runs when a logged-in user - in practice a store administrator - opens the gateway error logs page, and only stores with the PayPal gateway enabled are exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate-priority issue driven mainly by the admin-view precondition.
Unauthenticated remote attackers can plant stored cross-site scripting payloads in the Podlove Podcast Publisher plugin for WordPress (all versions up to and including 4.5.6) by sending a POST to the Auphonic webhook endpoint with any status_string value other than the literal string 'Done'; the handler writes the entire raw $_POST superglobal into the plugin log before it ever validates the webhook authkey. The injected script only executes later, when a logged-in administrator opens the plugin's logging/Support page in wp-admin, so successful exploitation is conditional on an admin viewing the poisoned log entry - impact is confined to that administrator's authenticated browser session and is low for confidentiality and integrity with no availability impact. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the vendor has shipped an upstream code fix, though an explicitly tagged patched release version is not independently confirmed.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Presto Player plugin for WordPress (all versions up to and including 4.5.1) lets unauthenticated attackers inject arbitrary JavaScript via comment content that is processed by the <presto-player> tag, with the payload executing in the browser of any user who later views the affected page. The issue is rated 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), with the scope-change metric reflecting that the injected script affects a component beyond the vulnerable plugin itself. Exploitation depends on a single initial comment being approved by a moderator, after which WordPress's default behavior of auto-approving subsequent comments from the same author removes the need for further admin intervention; there is no CISA KEV listing and no public exploit identified at time of analysis, making this a moderate-priority issue that is largely mitigated by upgrading to 4.5.2, disabling comments, or requiring manual approval for every comment.
Privilege escalation in the Groundhogg CRM, Newsletters & Marketing Automation plugin for WordPress (all versions through 4.8.3) lets an attacker-controlled account whose user_login is exactly 'groundhogg' and whose user_email matches one of the hardcoded support addresses be silently promoted to administrator when a legitimate admin invokes the plugin's support-access feature. Exploitation is a deliberate two-actor sequence: the attacker must first plant or self-register the matching account (possible when open registration or any other self-service account-creation path exists), after which an admin triggering the submit_ticket or process_send_support_access entry points causes create_support_user() to adopt and promote that account; on multisite the promotion reaches super admin level when the triggering administrator holds manage_network_options, resulting in full site takeover. No public exploit code and no confirmed actively exploited (CISA KEV) status were identified at time of analysis, and the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R reflects both the low-privileged account the attacker must first obtain and the administrative interaction the flaw depends on.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.
Unauthenticated attackers can store arbitrary JavaScript in the WordPress 'Real Estate Manager - Property Listing and Agent Management' plugin (all versions up to and including 7.3) by submitting a crafted 'first_name' value through the public agent registration form, with the payload executing when an administrator later opens the Agents admin page where the value is rendered unescaped. The plugin's reCAPTCHA control provides no practical barrier because validation only runs when the g-recaptcha-response parameter is present, so simply omitting that parameter bypasses the check entirely. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited, but the requirement for a privileged user to view the injected page keeps this a moderate-priority rather than emergency issue; version 7.4 fixes it.
Privilege escalation in the Groundhogg CRM, Newsletters, and Marketing Automation WordPress plugin (all versions up to and including 4.9) lets any authenticated user holding the default sales_rep role - which carries edit_contacts, view_notes, and add_notes but not edit_users or promote_users - take over an administrator account. The vulnerable process_edit() handler in the contacts admin page accepts an attacker-supplied 'user' parameter without an ownership or capability check, so a contact can be relinked to an administrator's WordPress user ID; generating a note containing the {auto_login_link} replacement tag then produces a valid permissions-key auto-login URL for that contact, which the attacker reads back through view_notes and visits to authenticate as the administrator. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), and the flaw requires an existing low-privileged account rather than anonymous access; no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3) lets an authenticated LatePoint user who holds the settings__edit capability overwrite the default_wp_role_for_customer setting with 'administrator', so that any LatePoint customer account self-registered afterwards is created with full WordPress administrator rights. The flaw is entirely server-side - the role restriction exists only in the UI dropdown and is never validated when the setting is persisted - but it is gated by two real prerequisites: a WordPress administrator must first delegate settings__edit to an agent or custom role, and a new customer registration must occur after the malicious value is saved for the escalation to materialize. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a genuine high-impact issue that nonetheless sits below its 8.8 headline score in practical priority.
Unauthenticated attackers can delete a limited set of files on WordPress sites running the rtMedia for WordPress, BuddyPress and bbPress plugin through version 4.7.13, because the upload processing routine performs insufficient file path validation and the plugin treats a publicly exposed nonce as an authorization gate. The rtmedia_upload_nonce that guards the deletion path is emitted into frontend JavaScript by any page rendering the rtMedia gallery or upload shortcode, so it can be harvested by any anonymous visitor, although the impact is deliberately limited to files the plugin classifies as 'safe' rather than critical system or configuration files. Affected sites on 4.7.14 or later are not exploitable; no public exploit code was identified at time of analysis and there is no evidence of active exploitation. The assessing vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting limited integrity and availability loss rather than the higher confidentiality weighting in the originally published CVSS score.
Unauthenticated attackers can trigger arbitrary WordPress action hooks on sites running the Avada (Fusion) Builder plugin up to and including 7.16.1, because the plugin dispatches a hook whose name is taken directly from an attacker-supplied form-field value without verifying authorization. The demonstrated impact is permanent destruction of site content - a crafted request deleted trashed posts, pages, and comments via the core wp_scheduled_delete action - with denial of service (e.g. wp_maybe_auto_update) and, where additional vulnerable third-party hook handlers are installed, further privileged writes; a blind arbitrary user/post-meta read also exists but its results are delivered only to the site owner and are not attacker-exfiltrable. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), this is a genuine high-priority issue rather than an inflated score, though it is not confirmed actively exploited and no public exploit code has been identified at time of analysis. The vendor addressed it in Avada 7.16.2.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
Unauthenticated password change against arbitrary WordPress accounts - including Administrator accounts - is possible through the Advanced Form Integration - Connect Forms to 300+ Apps plugin for WordPress in all versions up to and including 2.9.0, letting an attacker submit a public Contact Form 7 form carrying a victim's email address, the field key user_pass, and an attacker-chosen password value. The adfoin_ultimatememberac_send_data handler resolves the target user from the attacker-supplied email and forwards the attacker-controlled key/value pair directly to UM()->user()->update_profile() in the 'account' context, which deliberately bypasses Ultimate Member's banned-key validation and performs no sender identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction (CWE-287). The decisive gate is configuration, not attacker skill: an administrator must already have mapped public form inputs to the Ultimate Member 'Update Profile Field' action, which is why the assessed vector carries AC:H despite PR:N; no public exploit code has been identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Cross-site request forgery in the WordPress plugin Dashboard Notes (MIGHTYminnow) affects all versions through 1.0.3, letting an attacker craft a page or link that silently rides an authenticated privileged user's session to perform state-changing plugin actions. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) reflects that the attacker needs no server-side authentication (PR:N) but must successfully lure a logged-in user with access to the plugin's dashboard functionality into interacting with attacker-controlled content (UI:R); exploitation cannot occur without that victim action. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and the universal applicability of CSRF to unpatched WordPress plugins keep the practical risk meaningful for sites running 1.0.3 or earlier.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
PHP Object Injection in the Quiz And Survey Master plugin for WordPress (versions up to 11.2.7) allows an authenticated attacker with low privileges to execute arbitrary code or manipulate files via crafted serialized input. The vulnerability is network-reachable with low complexity and no user interaction, and can lead to full site compromise if a suitable gadget chain is present. No public exploit code has been identified at the time of analysis.
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.
PHP object injection in the WordPress plugin Product Configurator for WooCommerce through version 1.7.5 allows an authenticated, high-privileged user (typically an administrator or shop manager) to supply crafted serialized data that the plugin passes to unserialize(), potentially enabling object injection and, if a suitable POP gadget chain exists in the plugin, WooCommerce, or WordPress core, arbitrary code execution or similarly severe impact. The flaw is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires an active WooCommerce installation; no public exploit code or gadget chain is documented and no confirmed vendor-released fix version appears in the provided references, so no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the AcyMailing SMTP Newsletter WordPress plugin, versions through 11.1.0, allows unauthenticated remote attackers to inject malicious script into a generated web page that executes in a victim's browser when they are tricked into following a crafted link (CVSS 7.1, PR:N, UI:R). Because the payload is reflected and not stored server-side, exploitation hinges on luring a user - ideally an authenticated WordPress administrator - into triggering the request; no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a moderate-severity flaw (CWE-79) reported by Patchstack, with the specific vulnerable parameter or feature not named in the available description.
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Reflected cross-site scripting in the Heateor Support 'Sassy Social Share' WordPress plugin, affecting versions up to and including 3.3.79, lets an unauthenticated attacker inject script that executes in a victim's browser when the victim follows a crafted link or request and interacts with the page (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the payload is reflected rather than stored, it does not persist on the site and each successful attack is per-victim, with impact limited to what the victim's session can reach - highest when the victim is a logged-in administrator. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied; the issue was reported by Patchstack, whose advisory should be consulted to confirm the exact vulnerable parameter.
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.
Reflected cross-site scripting in the Basix NEX-Forms WordPress plugin (through version 9.3.1) allows remote attackers to inject script into a page that executes in a victim's browser when that victim opens a crafted link, with user interaction required per the CVSS vector (UI:R) and no authentication required to trigger the flaw (PR:N). Successful exploitation can lead to theft of session cookies or authentication tokens and, because the vulnerable component scores S:C, the resulting script runs in the security context of the affected WordPress site - making a lured privileged administrator a particularly valuable target. The consequences are limited in scope: the payload is not stored and only affects users who follow the attacker's specific link, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated path traversal in ZealousWeb's Generate PDF using Contact Form 7 WordPress plugin, affecting all releases through 4.2.1, lets a remote attacker read arbitrary files from the web server, an impact mirrored by the CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N - confidentiality only, no integrity or availability impact). Any WordPress site with this add-on installed, active, and reachable is exposed if its PDF generation/download endpoint accepts unauthenticated requests; the practical limiting factor is the plugin's comparatively small install base rather than any authentication or configuration barrier. At time of analysis no public exploit code has been identified and there is no CISA KEV listing, but the low-complexity, unauthenticated nature of the flaw makes it a natural candidate for automated mass scanning.
Reflected cross-site scripting in the 'Simple Payment' WordPress plugin (yalla ya!, versions through 2.5.4) lets an unauthenticated remote attacker inject script into a page generated by the plugin, which then executes in the browser of any user who clicks an attacker-crafted link while the plugin is active. Because the payload is reflected rather than stored, every victim must be individually social-engineered into following a malicious URL, and the resulting impact is limited to what is accessible within that victim's browser session (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis and the flaw has not been reported as confirmed actively exploited (CISA KEV), so the practical near-term risk is opportunistic rather than mass-exploitation driven.
Reflected cross-site scripting in the Salon Booking System WordPress plugin (all versions through 10.31.5) lets remote, unauthenticated attackers inject and execute arbitrary script by luring a victim to a crafted URL or request. Exploitation requires the victim to load the malicious request (UI:R), so it cannot be triggered silently or server-to-server; the resulting script runs in the victim's browser session and can enable cookie/session theft, credential phishing, or actions performed as the victim. Patchstack rates it CVSS 7.1 (High), while the independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N because the impact is browser-scoped rather than server-scoped; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.
Reflected cross-site scripting in Crocoblock's JetBlog WordPress plugin (all versions through 2.4.10) lets unauthenticated attackers execute arbitrary script in a victim's browser when that victim loads a crafted request or URL containing unsanitized input. The flaw is reflected rather than stored, so each exploitation requires an individually tricked user and the payload does not persist on the site; impact is greatest when the lured user is an authenticated administrator, allowing session or privileged-action abuse. Assessed at CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and reported by Patchstack, with no public exploit identified at time of analysis and no confirmed active exploitation.
Reflected cross-site scripting (XSS) in the UsersWP WordPress plugin through version 1.2.73 allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation can lead to session hijacking, data theft, or actions performed on behalf of the victim, especially if the victim has administrative privileges. No public exploit code or confirmed active exploitation exists at time of analysis; the CVSS score is 7.1 with a user-interaction requirement (UI:R).
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.
Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Reflected cross-site scripting (XSS) in the UpSolution Core (us-core) WordPress plugin through version 8.44 allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session when they click a crafted link, enabling session theft or page defacement. Exploitation requires the plugin to be active and the victim to interact with the malicious URL (UI:R); no public exploit code is identified at time of analysis. The independent assessment rates this as medium severity (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability impact.
Reflected cross-site scripting (CWE-79) in the Welcart e-Commerce WordPress plugin (usc-e-shop) affects all versions up to and including 2.12.3, allowing a remote unauthenticated attacker to inject script that executes in a victim's browser session. Exploitation depends on user interaction (UI:R): an attacker must lure a user - realistically a logged-in WordPress administrator or shop operator - into clicking a crafted link or visiting a page that reflects the malicious parameter, at which point the injected script can act with that user's privileges and, per the CVSS scope change (S:C), potentially affect resources beyond the vulnerable component. The vulnerability carries a CVSS 3.1 base score of 7.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patched version was confirmed from the available data.
Attackers can forge state-changing requests in the Featured Image from URL WordPress plugin through 6.0.7, allowing them to cause an authenticated administrator to perform unintended actions, but only if the administrator interacts with attacker-controlled content (UI:R). The input CVSS of 8.8 overstates impact; independent assessment rates confidentiality and integrity as Low and availability as None. No public exploit code identified at time of analysis; consult the Patchstack advisory for remediation.
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.
Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.
Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Media Library Assistant (versions through 3.41) allows an attacker to persist a crafted script payload into media item metadata or attachment fields that the plugin later renders in the admin interface, where it executes in the browser context of an administrator or editor who loads the affected page. Exploitation is not fully self-contained: it requires user interaction (the victim must view the poisoned page) and, consistent with our assessed vector (PR:L rather than the CVE record's PR:N), realistically requires the attacker to hold some content-submission capability on the target site in order to store the payload. Impact is limited to low confidentiality, integrity, and availability within the victim's browser session, and no public exploit or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Reflected cross-site scripting in the ShopBuilder - Elementor WooCommerce Builder Addons plugin for WordPress (versions through 3.4.1) lets a remote attacker inject arbitrary script into a page the plugin generates from unvalidated input, so the payload executes in the browser of any user who opens a crafted link. No authentication is required of the attacker (CVSS PR:N), but exploitation depends on victim interaction with an active session (CVSS UI:R), and the impact is greatest when the lured target is a logged-in store administrator because the script then runs inside the WordPress dashboard. The risk is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) by independent assessment; no public exploit identified at time of analysis, and no vendor-released patch version is specified in the available intelligence, so the Patchstack advisory should be monitored for a fixed release.