WordPress
Monthly
Stored cross-site scripting in the Robo Gallery WordPress plugin before 5.2.6 lets authenticated users with the Contributor role or higher save unsanitized gallery settings that are later rendered on the gallery edit screen, so the injected JavaScript executes in the browser session of any administrator who opens that gallery for editing. This is a moderate, authenticated-only stored XSS (CWE-79): the attacker must already hold Contributor-level access, and the payload stays inert until a higher-privileged user interacts with the poisoned gallery (UI:R is a hard prerequisite). Publicly available exploit code exists, but there is no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available in 5.2.6; sites that do not grant Contributor+ accounts to untrusted parties face little practical exposure.
Stored cross-site scripting in the Robo Gallery WordPress plugin before version 5.2.6 allows an authenticated user holding the Author role or higher to save a crafted gallery setting that is later rendered without escaping on the frontend, so the script executes in the browser of any visitor who views the poisoned gallery - including administrators. The injection point is a gallery setting editable only by Author-and-above accounts, and the payload only fires when a victim subsequently loads the affected page, so exploitation requires an authenticated foothold plus victim page views rather than being a one-step anonymous attack. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no indication of confirmed active exploitation in CISA KEV; the vendor has released a fix in 5.2.6, and this is assessed as a moderate, not top-priority, issue.
Stored cross-site scripting in the Robo Gallery WordPress plugin (versions before 5.2.6) lets an authenticated user holding the Author role or higher plant JavaScript inside image alt text, which one gallery layout renders without sanitization or escaping, so the script executes in the browser of any visitor who views that gallery - including administrators. Exploitation requires a valid Author-level account on a site running a vulnerable version, the ability to set gallery image alt text, and use of the specific affected layout, with a separate victim having to open the gallery for the payload to fire; publicly available exploit code exists, but there is no indication of confirmed active exploitation. Severity is assessed as moderate and privilege-gated rather than remote unauthenticated code execution, and the vendor has released a fixed version.
Stored cross-site scripting in the Robo Gallery WordPress plugin before 5.2.6 lets an authenticated attacker holding the Author role or higher save a malicious payload inside one of the plugin's image settings, which the gallery page then outputs without sanitisation or escaping so the script executes in the browser of any visitor viewing that gallery - including administrators - and notably even on multisite installs where the unfiltered_html capability has been removed. Publicly available exploit code exists and the vendor has released a fix in 5.2.6. Exploitation is gated on possessing at least Author-level access and on a victim actually rendering the poisoned gallery page, so this is a moderate-risk, elevated-priority patch rather than an emergency, and sites with no untrusted Author-or-above accounts carry substantially lower practical risk.
Information disclosure in the Dokan multivendor marketplace plugin for WordPress (versions before 5.2.0) lets any authenticated vendor read the commission rate and fixed fee that the marketplace administrator configured for other vendors, simply by requesting a commission calculation for someone else's vendor identifier. The root cause is a missing ownership check (CWE-200 information exposure) on the commission-calculation feature, which is reachable by a logged-in vendor account - a low barrier on marketplaces that allow self-service vendor registration. Publicly available exploit code exists per the WPScan advisory, no CISA KEV listing has been recorded, and impact is confined to disclosure of pricing configuration: there is no data modification, privilege escalation, or service disruption. The vendor has released a fix in version 5.2.0, and the independent assessment confirms this as a genuinely low-severity issue with a consistent risk picture.
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.
Envira Gallery, a WordPress gallery plugin, fails to verify that a user is authorized to read a gallery before rendering it in versions before 1.16.2, letting an authenticated attacker with author-level publishing privileges embed another user's gallery and expose its non-public metadata to unauthenticated visitors. Publicly available exploit code exists, and the vendor has released a fix in 1.16.2. The measured risk is low (CVSS 2.7), because exploitation requires an author-level account on a multi-author site and disclosure is limited to gallery metadata rather than full account or site compromise.
Envira Gallery before 1.16.2 contains a missing authorization flaw in its gallery-conversion feature, allowing an authenticated WordPress user with contributor-level access to create and publish gallery posts that the plugin's settings would otherwise withhold from them. Publicly available exploit code exists, but impact is limited to gallery content integrity; there is no code execution, data disclosure, or site takeover, and upgrading to 1.16.2 remediates the issue.
Authenticated information disclosure in the Envira Gallery WordPress plugin affects all versions before 1.16.2, allowing any user who can create or edit a gallery - Author role and above by default - to retrieve the title and excerpt of other users' private, draft, pending, and trashed posts that WordPress would normally withhold. The flaw is a missing authorization check (CWE-200) on the image identifier supplied when adding media to a gallery, and it is rated low severity (vendor CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N; our independent assessment lowers the privilege requirement to PR:L since Author is the default capability for gallery editing). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and a vendor fix is available in version 1.16.2.
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a subscriber-level account - to invoke an AJAX action that has no capability or nonce check and make the site send arbitrary HTML email from its own mail system to arbitrary recipients. The practical impact is outbound mail relay used for phishing that carries the victim site's domain and sending reputation, with no direct data disclosure or code execution; the assessed CVSS vector (PR:L, I:L, no C/A impact) keeps this at medium severity (CVSS 4.3). Publicly available exploit code exists, and there is no KEV entry confirming active exploitation; the primary gating factor is authentication, which is trivially obtained on membership sites that permit open self-service registration.
Stored cross-site scripting in the Post Snippets WordPress plugin through 4.2.4 lets an authenticated user with Contributor-level access or above inject arbitrary JavaScript through snippet variable values, which then executes in the browser of any higher-privileged user (such as an editor or administrator) who views the rendered content. The plugin substitutes variable values into snippet output without escaping them, so injected script runs in the context of the viewing user's session and can be leveraged for session or credential theft and privileged actions performed on the victim's behalf. Publicly available exploit code exists and WPScan published the vulnerability, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV); real-world exposure is limited to sites that grant Contributor or snippet-authoring access to untrusted or lower-trust users.
Authenticated low-privilege users on WordPress/WooCommerce sites running the ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce plugin (woo-alidropship) through version 2.2.4 can reach plugin functionality they are not authorized to use, because affected endpoints omit authorization/capability checks (CWE-862). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), the practical impact is limited to low-integrity modification - no confidentiality or availability loss - and exploitation requires the attacker to already hold a valid low-privilege account on the target site, so sites that do not allow untrusted user registration have sharply reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and this remains a low-to-moderate priority issue rather than an emergency patch item.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Authenticated subscriber-level bypass in the VideoWhisper MicroPayments WordPress plugin (versions up to and including 3.2.9) lets a low-privilege account tamper with payment and entitlement state that should require higher privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base score 5.4) describes a network-reachable flaw that still requires the attacker to hold a subscriber account, which is the primary limiting factor: the target site must either allow subscriber self-registration or the attacker must already possess such an account. Impact is bounded to partial integrity and availability loss with no confidentiality exposure, and no public exploit code was identified at time of analysis.
An unauthenticated bypass in the 'Pay With MetaMask For WooCommerce - Cryptocurrency Payment Gateway' WordPress plugin (all versions up to and including 1.7.2) lets remote attackers circumvent the plugin's authenticity/verification checks, altering limited aspects of application state without logging in, per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Because the vector carries PR:N and UI:N, unauthenticated remote attackers can trigger the flaw on any site where the plugin is active, but the impact is confined to integrity only (I:L) with no confidentiality or availability effect, keeping this a moderate-severity issue rather than a critical one. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS signal was supplied; the affected population is limited to WordPress/WooCommerce sites running this niche cryptocurrency payment gateway.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Unauthenticated content injection in the Kutethemes 'Boutique' WordPress theme at version 2.3.3 and earlier lets remote attackers reach a shortcode-handling path and inject arbitrary content into affected sites. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any internet-facing WordPress installation with this commercial theme active is exposed by default; the attack surface is bounded to sites running this specific theme. Impact is assessed as limited content injection and partial data exposure (C:L/I:L/A:N) rather than server compromise, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in unpatched, theme-deployed sites.
Missing authorization checks in the Upcasted S3 Offload plugin (published as 'AWS S3 for WordPress Plugin - Upcasted') through version 3.1.0 let any authenticated user holding only the Subscriber role invoke plugin functionality that should be reserved for higher-privileged accounts, yielding limited confidentiality, integrity, and availability impact rather than full site takeover. The attack is network-reachable and requires no user interaction, but the PR:L rating means an attacker must first possess a valid low-privilege WordPress account - most commonly obtained through open or self-service user registration - which is the principal limiting factor on real-world exposure. There is no public exploit code identified at time of analysis and no indication of active exploitation, and the moderate CVSS score of 6.3 reflects the constrained, low-impact actions that the missing check exposes.
Unauthenticated sensitive data exposure in the WordPress plugin Swish Migrate and Backup (versions 1.4.0 and earlier) lets remote attackers retrieve data the plugin should have kept private, with the impact confined to confidentiality (CVSS 5.9, C:H/I:N/A:N). Exploitation is not trivial: the CVSS vector (AV:N/AC:H/PR:N/UI:N) marks high attack complexity, meaning a specific transient or plugin-operation condition - such as a backup or migration in progress, or an exposed backup artifact - must be met before the leak occurs, and the available data does not identify the exact trigger. At time of analysis no public exploit code has been identified, the issue was reported by Patchstack, and it is a moderate-priority information disclosure rather than a top-tier emergency; the niche deployment of this plugin further limits realistic exploitation.
Missing authorization checks in the Jetpack VideoPress WordPress plugin versions 3.6 and earlier let an authenticated Subscriber-level account perform actions that should be limited to higher-privileged users, giving a low-privileged attacker the ability to modify data (integrity impact only, with no confidentiality or availability effect per the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5). Sites are exposed if they run an affected plugin version and allow the attacker to obtain a Subscriber account, which is trivial on installations with open user registration enabled; fully unauthenticated attackers cannot exploit the flaw. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority hardening item rather than an emergency, though the absence of a named vulnerable endpoint in the published advisory makes the true reachable surface hard to bound.
Trusted-credential abuse in CodePeople2 Sell Downloads (WordPress plugin) up to version 1.2.3 allows unauthenticated remote attackers to bypass origin verification and access or modify limited data, such as download or order metadata. The flaw, tracked as CVE-2026-94590, has a CVSS score of 6.5 and is not known to be actively exploited; no public exploit code has been identified. Only WordPress sites with this specific, low-prevalence plugin active are affected, making the real-world risk moderate and low-priority.
Missing authorization in VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) versions 1.1.3 and earlier allows unauthenticated remote attackers to tamper with limited gift-card-related data on WordPress/WooCommerce sites where the plugin is active. The flaw (CWE-862) stems from the plugin failing to enforce an access-control check on a restricted function, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to integrity (VI:L) with no confidentiality or availability impact, resulting in a medium-severity rating.
Unauthenticated remote attackers can retrieve embedded sensitive information from WordPress sites running the WP Rollback plugin through version 3.1.2, because the plugin places sensitive data into data it sends back to the client (CWE-201). The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are needed but attack complexity is high, so success depends on conditions the attacker does not control - such as the specific sensitive data being present in the affected responses or a particular plugin state. There is no public exploit code identified at time of analysis and no confirmation of active exploitation (CISA KEV); the exposure is limited to confidentiality, with no integrity or availability impact, and the exact data exposed is not described in the available advisory and should be confirmed with the vendor/Patchstack.
Stored cross-site scripting in the PeproDev Ultimate Profile Solutions WordPress plugin (all versions up to and including 8.2.36) allows an authenticated attacker holding contributor-level privileges or higher to inject arbitrary JavaScript into a page via the 'button' attribute of the shortcode, which is stored without sanitization and rendered without output escaping. The payload executes in the browser of any user who later views the injected page, and because the injected content lives in persistent post data it can trigger against administrators and other privileged viewers. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this should be treated as a moderate-priority issue rather than an emergency.
Arbitrary file deletion in the WordPress plugin Listdom: AI-powered Business Directory with Classifieds Ads Listings (all versions up to and including 6.1.2) lets an authenticated administrator delete files anywhere on the server by supplying a traversal path to the plugin's CSV import routine (LSD_Menus_IX_CSV::import). The practical impact is high for integrity and availability - deleting a sensitive file such as wp-config.php can drop the site into a re-installation state and enable full takeover/RCE - but the requirement for administrator-level access (CVSS PR:H) makes this a high-barrier, medium-severity issue rather than a widespread emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in Premium Packages - Sell Digital Products Securely (wpdm-premium-packages) through version 7.2.6 lets authenticated attackers with subscriber-level access or above inject arbitrary web scripts into checkout billing fields such as phone, state, taxid, and email, which are then rendered in the customer dashboard without adequate escaping. The issue is rated CVSS 6.4 Medium and requires an account on the target WordPress site, but exploitation does not require administrative privileges; script execution occurs when a higher-privileged user views the poisoned billing information. No public exploit has been identified at time of analysis, and the primary fix is an upstream changeset rather than a confirmed tagged patched release.
Stored cross-site scripting in the Avada theme for WordPress (versions up to and including 7.16.1) allows authenticated attackers with Subscriber-level access or higher to inject javascript: URLs into author social link profile fields, which execute when a victim visits the attacker's author archive page and clicks the affected social icon. Exploitation is constrained by required user interaction and by the Avada option 'Open Social Icons in a New Window' being set to Off so the browser does not block the javascript: URL in a new tab. This is a moderate-severity issue (CVSS 6.4) that does not rise to emergency priority, and no public exploit was identified at time of analysis.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored DOM-based cross-site scripting in the SureDash - Community, Courses & Member Dashboard plugin for WordPress (all versions up to and including 1.12.1) allows authenticated attackers with subscriber-level access or above to plant arbitrary script inside community post content by entity-encoding a payload in an image's 'alt' attribute. The payload evades server-side wp_kses filtering because kses allows the img/alt combination and does not normalize HTML entities within attribute values, and it only executes client-side when the bundled GLightbox library reads the .alt DOM property and writes the decoded value into innerHTML as a victim views the injected page. There is no public exploit identified at time of analysis, and exploitation demands a valid low-privilege account plus an active community/GLightbox rendering path, so this is a genuine but moderate-priority issue rather than a top-tier emergency; the vendor has released SureDash 1.12.2 to address it.
Authenticated subscribers (or any logged-in user) on WordPress sites running the AutomatorWP plugin up to and including 5.8.4 can enumerate Fluent Forms records - specifically form IDs and titles from the fluentform_forms database table - because a plugin AJAX handler performs no authorization check. The flaw is network-reachable but requires a valid low-privilege account plus the Fluent Forms plugin and AutomatorWP's Fluent Forms integration to be active, and exposure is limited to form identifiers and titles rather than submissions or configuration data (CVSS 4.3, CWE-862). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); overall this is a genuinely low-priority information-disclosure defect.
Time-based blind SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.9) allows authenticated attackers holding subscriber-level access or above to append extra SQL into an existing query and read sensitive information from the site database. The issue is second-order: a subscriber stores a display_name value containing a single quote, which WordPress preserves verbatim, and the payload only fires later when WdkCachedUserEditor::update_listings_user_editor() re-reads that cached value into the SQL sink without escaping or prepared-statement parameterization. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the impact is confidentiality-only and blind, so exfiltration is slow and generates measurable request volume; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting (XSS) in the Retainful Email Marketing for WordPress and WooCommerce plugin (versions ≤1.0.10) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'data' parameter in the plugin's REST API, which execute when a victim views the affected page. This vulnerability requires a low-privilege account and user interaction, and no public exploit code or active exploitation has been identified. It is a moderate-severity (CVSS 6.4) issue that should be patched promptly.
Reflected cross-site scripting in WPForms Lite through 2.0.2.1 allows an unauthenticated attacker to execute arbitrary script in a victim's browser if the site administrator previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page. The attacker must trick a victim into clicking a crafted link containing a malicious value for the referenced query parameter, and the flaw is rated CVSS 4.7 with high attack complexity and required user interaction. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Stored cross-site scripting in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to and including 1.4.123) allows authenticated attackers with Subscriber-level access to inject arbitrary web scripts via the 'stm_f_s' parameter. The CSRF nonce protecting the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, so any logged-in user can retrieve it, removing the usual barrier to exploitation. This is a moderate-risk issue (CVSS 6.4) and no public exploit has been identified at the time of analysis.
Stored cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.8.4) lets an attacker persist arbitrary JavaScript through the member profile 'country' field, which then executes in the browser of any user - typically an administrator - who views the affected member listing or profile page. By default the attacker must hold an authenticated account at subscriber level or above, but the vector widens to fully unauthenticated attackers whenever the plugin's 'Enable Free Membership' option is on, because that setting permits anonymous front-end registration and profile submission. Rated CVSS 6.4 (Medium) and reported by Wordfence, there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the fix is the vendor-released version 4.8.5.
Sensitive information exposure in the SpeedyCache - Cache, Optimization, Performance WordPress plugin through version 1.4.2 allows an unauthenticated attacker to read the full name and email address of returning commenters by fetching a publicly cached page whose personalized comment-form prefill was written into the site-wide cache. The root problem is asymmetric handling of WordPress commenter cookies: advanced-cache.php suppresses cached delivery on the read path for requests carrying comment_author_* / comment_author_email_* cookies, but the equivalent check is missing on the write path in cache.php, so the personalized render is still stored under the public URL and can be retrieved by any cookie-less attacker who requests that same URL before the entry is regenerated. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), it leaks only the identity of whichever commenter's render happened to be cached; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated arbitrary file upload in WP CV Builder plugin versions up to and including 1.3.1 allows remote attackers to write arbitrary content as .png files to the WordPress uploads directory via the 'wp_save_signature_image' function, which lacks a capability check. This integrity-only primitive requires no authentication and affects default installations, but does not directly enable code execution. No public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Team - Team Members Showcase (slug 'tlp-team', vendor techlabpro1) affects all versions up to and including 6.0.2 and lets authenticated attackers with contributor-level privileges or above persist arbitrary JavaScript via the 'ttp_filter_taxonomy' taxonomy-meta value of an attacker-chosen post. The script then executes in the browser of any user - including higher-privileged users such as editors or administrators - who views a page where the plugin's shortcode renders that taxonomy filter output, giving a CVSS 6.4 impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, so risk is concentrated on sites that grant contributor access to untrusted users; there is no unauthenticated path (PR:L).
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin through version 3.28.36 lets authenticated users with Contributor-level or higher access inject arbitrary web scripts by exploiting a kses/mutation-XSS bypass in the get_dynamic_values function, which performs text-level find-and-replace on post content without HTML-aware parsing. The stored payload executes when another user views the affected page, and the CVE carries a CVSS 3.1 score of 6.4 with scope change. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit identified at time of analysis; practical risk is limited to sites that grant untrusted users Contributor-or-higher roles and have the plugin active.
Reflected cross-site scripting in the Favicon Rotator plugin for WordPress (all versions up to and including 1.2.11) allows unauthenticated attackers to inject arbitrary JavaScript through any request parameter prefixed with 'fvrt_', which the plugin reflects back into a page without adequate sanitization or output escaping. Exploitation is not direct: because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, the attacker must deliver a crafted link and convince a victim to click it, after which the script executes only in that victim's browser, potentially stealing session data, altering page content, or acting as the victim - with an administrator victim yielding the greatest impact. This is a moderate-severity reflected XSS that warrants routine, lower-priority patching; no public exploit code was identified at time of analysis, and the vendor's 1.2.12 release addresses the flaw.
Authenticated SQL injection in WP Booking System - Booking Calendar versions up to and including 2.1.0.1 allows subscriber-level attackers to extract sensitive database information via the 'current_month' parameter. The vulnerability is a regression: a capability check added in 2.0.19.11-2.0.19.14 to fix CVE-2024-50425 was removed in version 2.1, and no nonce validation is required, so any logged-in subscriber can reach the vulnerable AJAX handler. No public exploit code or active exploitation has been identified at time of analysis, and the assessed severity is moderate (CVSS 6.5).
Stored cross-site scripting in the Responsive Lightbox & Gallery WordPress plugin (all versions through 2.7.9) lets authenticated attackers with editor-level privileges or higher inject arbitrary web scripts through the 'comment' parameter, which then execute when a site visitor opens the lightbox on an affected image. Realistic exploitation is heavily constrained by stacked prerequisites: the plugin's 'Comments' lightbox setting must be explicitly enabled (it is off by default), a moderator must approve the injected comment, the attacker must already hold a high-privilege account, and a visitor must click the affected image - which is why this is assessed as a low-priority issue despite the network attack vector. No public exploit code has been identified at the time of analysis and the flaw is not listed in CISA KEV; the CVSS 3.1 base score is 4.4 (assessed vector AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).
Reflected cross-site scripting (XSS) in the Payment Plugins for Stripe WooCommerce WordPress plugin, affecting all versions up to and including 4.0.17, enables unauthenticated attackers to inject arbitrary web scripts through the '#response' URL fragment when a victim opens a crafted link. Exploitation is further conditional on the plugin's 'Generic Errors' setting being unchecked, which causes raw Stripe error strings to be reflected into the page; there is no public exploit identified at time of analysis and no CISA KEV listing. The vendor-provided CVSS 3.1 score is 6.1 (moderate), and the independent assessment raises attack complexity to High given the required non-default configuration and mandatory user interaction.
Authenticated directory traversal in the SiteOrigin Widgets Bundle WordPress plugin (all versions up to and including 1.74.3) allows contributor-level users and above to read arbitrary files on the server through the get_instance_css function, exposing sensitive data such as wp-config.php secrets. Exploitation requires only a low-privilege contributor account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to read-only information disclosure with no direct write or code-execution impact; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited. Overall this is a credible but moderate-priority issue rather than a top-tier emergency, with risk concentrated on sites that grant contributor access broadly.
Stored cross-site scripting in the WP User Frontend WordPress plugin (all versions up to and including 4.3.12) allows any authenticated user with subscriber-level access or higher to persist arbitrary JavaScript that executes when a privileged user - typically an administrator - opens the affected transactions page. The root cause is insufficient sanitization and output escaping of the 'wpuf_payment_method' parameter: attackers bypass sanitize_text_field() by appending a valid gateway keyword such as 'bank' to the HTML payload, so the filter returns only the keyword for gateway routing while the full raw malicious value is stored and later rendered unescaped in the admin transactions list. Wordfence reported the issue with a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis, and there is no confirmed evidence of active exploitation (no CISA KEV listing).
Fluent Forms for WordPress (all versions up to and including 6.2.5) fails to verify that a user is authorized before performing several form-management actions, allowing an authenticated attacker holding Custom-level access or above to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings. The flaw is a missing-authorization issue (CWE-862) reachable over the network with low complexity and no user interaction once a qualifying account exists, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) reflects limited confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the practical exposure is concentrated in multi-user sites that provision low-privilege or custom roles.
Broken access control in the Tutor LMS WordPress plugin before 4.1.1 lets an authenticated user with instructor-level privileges reassign the parent of arbitrary posts on the site, allowing them to absorb other instructors' course content into their own courses and to orphan legitimate published content so it becomes unreachable. The root issue is an insecure direct object reference (CWE-639) in the plugin's course content ordering handler, which never verifies that the posts named in the request belong to a course the requester manages. No public exploit code has been identified at time of analysis, and the practical risk is confined to multi-instructor deployments that hand instructor roles to semi-trusted or self-registered users; the vendor has released a fix in Tutor LMS 4.1.1.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin before 1.3.6 allows authenticated users with Contributor-level access or higher to save JavaScript into one of the plugin's gallery settings, which is then written into an HTML attribute without sanitization or escaping, so the payload executes in the browser of any user - including an administrator - who views a page containing the gallery. Exploitation is not self-triggering: an attacker needs at least a Contributor account plus a victim who loads the affected page (UI:R), and sites that do not grant untrusted users posting roles are largely unaffected. No public exploit code has been identified at time of analysis and no EPSS score was supplied in the available intelligence; the vendor has released a fix, and our independent reassessment rates the issue MEDIUM (CVSS 3.1 base reflecting PR:L, S:C, C:L/I:L/A:N), which is lower in privilege prerequisite but broader in scope than NVD's published 6.8 vector.
WordPress sites running the W3 Total Cache plugin before 2.10.6 let an authenticated user with the Author role or higher plant media-import content that, once an administrator executes the plugin's import action, copies an arbitrary server-readable file - such as wp-config.php or a backup/credential file - into a publicly served directory where it can be fetched without authentication. The defect is a path-traversal / missing file-type restriction issue (CWE-22) rated 5.4 (medium) under CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N, yielding read-only information disclosure with no integrity or availability impact. A vendor patch is available in 2.10.6, no public exploit code has been identified at time of analysis, and because the attack cannot be completed alone - a privileged administrator must trigger the import, and the target file must be readable by the web-server process - practical priority is moderate rather than urgent.
Unrestricted brute-forcing of the email-verification PIN in the Contest Gallery WordPress plugin (all versions before 33.0.1) lets unauthenticated attackers guess a short numeric code and complete front-end registration for an email address they do not own, resulting in an authenticated WordPress session that the plugin treats as verified. Exploitation requires that the plugin's public front-end registration with email verification be enabled, and the practical ceiling is the privilege level the plugin assigns to self-registered accounts - typically low-privilege - rather than administrative access, which keeps this a genuine but moderate-severity authentication weakness rather than a critical one. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); the vendor has released a fix in version 33.0.1.
Unauthenticated information disclosure in the Booking Package WordPress plugin before 1.7.30 lets remote attackers retrieve other customers' stored reservation details and booking cancellation tokens because the data-returning endpoint omits authorization checks. Any WordPress site running the affected plugin with stored reservations is exposed over the network without credentials, though impact is confined to confidentiality and availability/integrity are unaffected (CVSS 5.3, CWE-200). No public exploit code or confirmed active exploitation was identified in the available intelligence.
Unauthenticated information disclosure in the WordPress plugin 'Accept PayPal Payments using Contact Form 7' (all versions before 4.0.7) allows any remote visitor to download the stored form submissions - name, email, telephone, postal address, message and associated payment metadata - of every person who submitted a payment form. The plugin's export routine performs no authorization check whatsoever, so exploitation requires no account, no user interaction and no non-default configuration; the only practical preconditions are that the plugin is installed and that at least one submission has been stored. Our independent assessment rates confidentiality impact as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) rather than the feed-supplied C:L, and no public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor fix is available in version 4.0.7.
Unauthenticated attackers can forge stored transaction statuses and inject the Accept PayPal Payments using Contact Form 7 plugin's status metadata onto arbitrary WordPress posts, affecting all versions of the plugin prior to 4.0.7. The flaw (CVE-2026-105989, CVSS 5.3, CWE-862 Missing Authorization) stems from an AJAX action that ships without any authorization or nonce/request-validation check, so it is reachable by remote unauthenticated requests against default installations with the plugin active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. Impact is confined to integrity (C:N/I:L/A:N), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated users with Contributor role or higher can permanently delete media attachments owned by other users, including administrators, in Portfolio Filter Gallery versions 2.0.2 through before 2.2.1 due to a missing per-object authorization check in the plugin's attachment deletion handler. The vendor has released patch version 2.2.1; no public exploit code is identified at time of analysis. This is a low-priority, defense-in-depth issue per independent assessment, with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, relevant primarily to multi-author or open-registration WordPress sites.
Authenticated attackers with Contributor-level access can exploit missing authorization checks in the Portfolio Filter Gallery WordPress plugin (versions before 2.2.1) to read, modify, and delete other users' galleries and site-wide gallery filters. This is a moderate-severity issue (CVSS 4.7) requiring a valid low-privileged account; no public exploit identified at time of analysis. A vendor patch is available in version 2.2.1.
Stored cross-site scripting in the Rank Math SEO WordPress plugin before 1.0.280 allows an account that can manage redirections (Administrators by default) to persist JavaScript in a redirection source value that then executes in the browser session of any user who opens the redirections administrative list view, including a Super Administrator on a multisite install. Exploitation requires a high-privileged authenticated account plus victim interaction (someone must open the affected admin view), and the impact is bounded to limited confidentiality and integrity loss, giving a low CVSS 3.1 base score of 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
SQL injection in Rank Math SEO before 1.0.280 allows an authenticated high-privilege user, such as an administrator, to inject arbitrary SQL through an unsanitized parameter, potentially reading limited data from the WordPress database. The requirement for administrator-level access (CVSS PR:H) sharply limits realistic risk; no public exploit was identified at time of analysis, and the issue is assessed as low priority despite network exploitability. A vendor patch is available in version 1.0.280.
Reflected cross-site scripting in the WordPress Download Manager plugin (codename065, all versions up to and including 3.3.57) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they load a crafted link containing a malicious payload in the 'REFERRER' parameter. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no authentication is required but a successful attack depends on victim interaction, making phishing or social-engineering delivery the realistic path rather than silent mass exploitation; the scope is changed (S:C), so script execution can reach beyond the plugin's own page context. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is best treated as a moderate-severity, high-prevalence-product hygiene fix rather than an emergency.
Stored cross-site scripting in the Graphene theme for WordPress through version 2.9.4 allows any authenticated user holding Subscriber-level access or above to plant persistent JavaScript in the theme's 'Current location' and 'Author profile image URL' profile fields, which then executes in the browser of every user who loads a page rendering that author data - including administrators. The flaw stems from insufficient input sanitization and output escaping (CWE-79) and was reported by Wordfence; the CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting that the attacker needs only a low-privilege account but the injected script can run in a scope beyond the vulnerable component. There is no KEV listing and no public exploit code identified at time of analysis, and the fixes appear in the WordPress theme Trac changesets comparing 2.9.4 against 2.9.6.
Stored cross-site scripting in the Brizy - Page Builder WordPress plugin, affecting all versions up to and including 2.8.18, lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through the 'brizy-compiled-sections' parameter when creating or editing page content. Because the payload is persisted and rendered without adequate escaping, the script executes in the browser of any user - including higher-privileged editors or administrators - who subsequently views the injected page, and the CVSS scope-change (S:C) reflects that the code runs in the victim's session context rather than the attacker's. Rated CVSS 6.4 and reported by Wordfence, there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, making this a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Stored cross-site scripting (XSS) in the Noptin Newsletter WordPress plugin up to version 4.3.10 allows unauthenticated attackers to inject malicious scripts that execute in the browser of a privileged user. Exploitation requires a published campaign post containing a [[subscriber.*]] merge tag and social engineering of an admin to visit a crafted preview URL; the independent assessment rates this as medium severity (CVSS 5.4) with high attack complexity and required user interaction. No public exploit identified at time of analysis.
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
Stored cross-site scripting in the GiveWP donation and fundraising plugin for WordPress (versions up to and including 4.17.0) lets authenticated attackers with Contributor-level access or above plant arbitrary JavaScript through the givewp_campaign_grid shortcode's attributes, which is then rendered unsanitized into any page or preview that loads the affected content. Exploitation requires a low-privileged account able to submit shortcode-bearing content and a higher-privileged or public visitor to view it, which is why it rates only moderate (CVSS 6.4, scope-changed C:L/I:L) and is a realistically lower-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing). The primary impact is session/token theft or privileged action abuse against the viewing user rather than site-wide compromise.
Stored cross-site scripting in the Kadence Blocks - Page Builder Toolkit for Gutenberg Editor WordPress plugin affects all versions up to and including 3.7.12, allowing an authenticated attacker holding author-level privileges or higher to inject arbitrary web scripts through a block's font-family attribute that execute when a victim views the injected page. The payload path is conditional: the malicious font-family encoding bypass only activates when the non-default 'Load Google Fonts Locally' site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, so default-configured sites are not exploitable through this vector. Exploitation additionally requires a victim to later access the poisoned page, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate, conditionally-exploitable issue rather than a top-tier priority given the privileged account requirement, the non-default setting, and the necessary victim interaction.
Stored cross-site scripting in the Embed Any Document WordPress plugin (all versions through 2.7.13) lets authenticated users with contributor-level access or above plant arbitrary JavaScript in post content through the plugin's 'embeddoc' shortcode; the script lies dormant until any visitor - commonly a higher-privileged editor or administrator reviewing the page - loads the affected content. The issue carries a CVSS 3.1 score of 6.4 (medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N that confirms remote reachability but an authenticated (PR:L) prerequisite and a scope change indicating execution in the context of the site. No public exploit code identified at time of analysis, and real-world exposure is limited to sites that run the vulnerable plugin, permit the 'embeddoc' shortcode in author-controllable content, and grant contributor accounts to untrusted parties.
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Stored cross-site scripting in the Church Admin plugin for WordPress (all versions up to and including 5.1.2) lets an authenticated attacker with subscriber-level access or above inject arbitrary script through the plugin's 'email' parameter, which is neither sanitized on input nor escaped on output. The injected payload persists in the database and executes in the browser of any user who later views the affected page - typically an administrator or other privileged staff member reviewing church member records - making it a low-complexity path from a throwaway subscriber account to privileged session compromise. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); with a CVSS base of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this should be treated as a patch-when-convenient issue rather than an emergency. Sites that permit open self-registration are meaningfully more exposed, since the attacker must first hold a valid low-privilege account.
Unauthenticated attackers can download exported WooCommerce order CSV files containing customer PII from sites using the WebToffee Order Export & Order Import plugin versions up to 2.7.8, but only when the wp-content/webtoffee_export/ directory lacks its .htaccess and index.php guard files-a state that can arise after uninstall/reinstall, migration, backup restore, or staging sync. The vulnerability (CWE-552) is rated moderate (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because exploitation additionally requires knowledge or brute-forcing of second-precision timestamp filenames; no public exploit code has been identified at time of analysis. The vendor has released version 2.7.9, which the referenced code changes suggest addresses the issue.
Stored cross-site scripting in the HivePress WordPress plugin (Business Directory, Listings & Classified Ads) affects all versions up to and including 1.7.31 and allows authenticated users with subscriber-level accounts or higher to inject arbitrary JavaScript that executes when other users view the affected listing page. Exploitation is conditional, not universal: the site must permit subscriber-level registration or listing submission, and an administrator must have configured a HivePress Text attribute whose display format places the %value% token inside an HTML attribute (for example title="%value%"), which is a documented but non-default HivePress pattern - a default configuration that renders %value% as normal element text is not exploitable. The vendor has released 1.7.32, which includes the fix for escaping field and token values; no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). Independent assessment rates the practical severity as moderate and conditionally exploitable, with attack complexity assessed as High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than the published AC:L rating.
Authenticated directory traversal in the Post Export Import with Media plugin for WordPress through 1.17.1 allows administrator-level users to read arbitrary files from the server by importing a crafted ZIP whose media_metadata.json file_path field contains traversal sequences while the destination filename uses an allowed extension. Although rated CVSS 4.9, real-world priority is materially reduced because the vector requires PR:H, meaning the attacker already holds WordPress administrator credentials; impact is read-only confidentiality disclosure with no integrity or availability effect. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Stored cross-site scripting in the GamiPress WordPress gamification plugin (all versions up to and including 7.9.4) allows any authenticated user with subscriber-level access or higher to inject arbitrary JavaScript through the 'video_id' parameter processed by the plugin's YouTube integration, which then executes in the browser of any user viewing the poisoned page. Exploitation requires a valid low-privilege account on the affected site plus a victim loading the injected content; the impact is most serious when the victim is an administrator, since the script runs in the site's origin and can be used to hijack sessions or perform privileged actions. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-severity (CVSS 6.4) but credible priority for sites that allow open registration and use the YouTube integration.
Stored cross-site scripting in the Sonaar MP3 Audio Player - Music Player, Podcast Player & Radio plugin for WordPress (all versions up to and including 5.14.2) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript through the plugin's shortcode attributes, which then executes in the browser of any user who later loads the affected page. The payload survives WordPress's save-time wp_kses_post sanitization because it is carried in a shortcode attribute rather than raw post HTML, so the unescaped value reaches render time intact. The flaw is authentication-gated and rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; there is no CISA KEV listing for this CVE.
Authenticated users with subscriber-level access or higher can alter site-wide semantic search configuration in the WordPress plugin AI Puffer (formerly AI Power) when an administrator has already granted their role the Knowledge Base ('sources') module through the plugin's Role Manager. The flaw affects all versions up to and including 2.4.89 and allows an attacker to change global values in the aipkit_options record - vector provider, embedding provider, embedding model, target ID, result count, and no-results text - that are otherwise administrator-only, giving a limited integrity impact with no confidentiality or availability loss. Exploitation requires a non-default role grant, so reachability is constrained; there is no public exploit and no confirmed active exploitation (no CISA KEV listing) at time of analysis, and the CVSS 3.1 vector scores this as low severity (3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
Authorization bypass in the WordPress plugin AI Puffer - Chat. Create. Automate. (formerly AI Power, slug gpt3-ai-content-generator) through version 2.4.89 lets an authenticated subscriber-level user rewrite the global options aipkit_training_general_settings and aipkit_indexing_field_settings, changing chunking parameters, file upload visibility and per-post-type field indexing for the whole site. Exploitation is tightly constrained: the attacker must already hold an account (PR:L per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) and an administrator must have explicitly granted the 'sources' module to that lower-privileged role through the plugin's Role Manager, a non-default configuration against which the plugin is not exploitable at all, which is why attack complexity is rated High. Impact is confined to configuration integrity with no data disclosure or availability loss, no public exploit identified at time of analysis, and this is assessed as a genuinely low-priority issue.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin, all versions up to and including 1.3.35) lets an authenticated attacker holding Contributor-level privileges or higher inject arbitrary JavaScript through table cell content, which then executes in the browser of any user who later views the affected page. The flaw is a classic CWE-79 defect: cell content is insufficiently sanitized on input and insufficiently escaped on output, so payloads persist in post data and are served back to victims. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with scope change because the script runs in the security context of the site and can reach higher-privileged viewers; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.
SQL injection in the 'sidx' parameter of the Smart Popup by Supsystic WordPress plugin (all versions up to and including 1.13.2) lets authenticated attackers with administrator-level privileges append arbitrary SQL statements to existing queries and extract sensitive data from the site's database. The CVSS vector confirms high privileges are required (PR:H) and impact is limited to confidentiality (C:H/I:N/A:N), and no public exploit or CISA KEV entry has been recorded - no public exploit identified at time of analysis - so despite a CVSS base score of 4.9 this is a low real-world-priority issue because an attacker must already hold the broad database and site access that administrators legitimately possess. Affected deployments are those running 1.13.2 or earlier; the vendor released 1.13.3 to remediate it.
Sensitive customer records - booking names, email addresses, and phone numbers - can be pulled without authentication from any WordPress site running the Booking Calendar plugin through version 11.4.3, because the wpbc_is_show_popover_in_flex_timeline() function returns booking data without an authorization check. The flaw is reachable against default installations over the network with no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 5.3 Medium), and its only prerequisite is that the site already holds bookings containing PII; sites with no bookings leak nothing. Impact is confined to confidentiality (C:L) with no write, code-execution, or availability effect, no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading beyond 11.4.3 removes the exposure.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress Download Manager plugin (codename065, versions up to and including 3.3.58) lets authenticated attackers with Contributor-level access or higher inject arbitrary JavaScript through the 'not_found' parameter processed by the plugin's shortcode handler; the stored script then runs in the browser of any user who views the injected page. The flaw is rooted in insufficient input sanitization and output escaping (CWE-79), has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and is corrected in version 3.3.59. Unauthenticated and Subscriber-only users cannot trigger it, and no public exploit code was identified at time of analysis.
Authenticated SQL injection in the FireBox - WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress (all versions up to and including 3.1.13) lets a user holding the edit_fireboxes capability append arbitrary SQL to the plugin's Form Display Condition query and read sensitive data from the site database. Because the preserveCampaignRoleAccess() migration on sites upgraded from before 3.1.10 grants edit_fireboxes to any role that previously held edit_posts, exploitation is possible at Author level on upgraded installations, while fresh installs from 3.1.10 onward require administrator access. The issue is rated CVSS 5.3 (AC:H, PR:L, confidentiality-only) and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48) allows unauthenticated attackers to inject arbitrary web scripts via the 'inputs' array key parameter. Exploitation requires tricking a user into clicking a crafted link while a vulnerable form page is reachable; the impact escalates if an authenticated administrator is the victim. No public exploit identified at time of analysis, and the vendor released a patch in version 1.15.49.
Stored cross-site scripting in the CleanTalk Anti-Spam WordPress plugin (versions up to and including 6.88) allows unauthenticated attackers to inject malicious scripts into comment fields, which then execute for any visitor viewing the affected page. Exploitation requires the attacker to first get one comment approved from their email address; default WordPress auto-approval then allows subsequent comments to store the payload without moderation. No public exploit code or active exploitation is identified at time of analysis, and the issue is rated CVSS 5.4 Medium (CWE-79).
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Stored cross-site scripting in the Feedzy RSS Aggregator WordPress plugin (all versions up to and including 5.2.10) lets an authenticated attacker with contributor-level access or above inject arbitrary JavaScript into pages by pointing the Gutenberg Feedzy Loop Block at an attacker-controlled RSS feed whose <title> element contains malicious HTML, which is then rendered into the page without escaping. Because post_content stores only a benign reference to the external feed URL, the payload evades save-time wp_kses filtering entirely and executes for any user who views the affected page. Exploitation requires a contributor account, the Loop Block in use, and attacker control of an external feed; no public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV, so risk is bounded by these preconditions rather than by the network-facing vector (CVSS 6.4).
Sensitive information exposure in the WordPress Download Manager plugin (codename065) through version 3.3.71 lets an authenticated subscriber-level user harvest the administrator's full Cookie header - including wordpress_logged_in_* session cookies - by abusing the 'first_name' parameter when the administrator triggers the plugin's 'Suspend' action against the attacker's account. Because the suspension email is compiled and sent synchronously inside the administrator's own authenticated HTTP request, the site's email template engine can resolve the admin's request context (Cookie header) at send time and inject it into the outgoing message, enabling session hijack and full account takeover once the attacker reads that email. Exploitation is not fully attacker-controlled: it depends on an administrator performing the Suspend action while authenticated, so the plugin carries a CVSS 3.1 base of 4.3 (independent assessment: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the Filter Everything - WordPress & WooCommerce Filters plugin (versions up to and including 1.9.6) lets unauthenticated remote attackers inject arbitrary web scripts via the flrt_elementor_load_more_anchor() output, which execute when a victim clicks a crafted link that reaches the Elementor load-more code path. The flaw is rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N and requires both victim interaction (UI:R) and the Elementor-integrated load-more/AJAX filtering feature to be reachable on the target page; no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Authorization bypass in the Hello Plus plugin for WordPress (all versions up to and including 1.7.7) allows authenticated users holding Contributor-level privileges or higher to publish their own Hello+ header/footer templates and to draft active templates belonging to higher-privileged users. The plugin's template-parts actions do not verify that the caller is authorized to publish or modify those documents, so the flaw is an integrity and availability problem rather than a data-disclosure one. Exploitation requires a valid low-privileged WordPress account, making multi-author sites and sites that allow Contributor-level self-registration the primary exposure; no public exploit code has been identified at time of analysis and there is no indication of active exploitation.
Stored cross-site scripting in the Download Manager WordPress plugin (all versions up to and including 3.3.71) allows an authenticated attacker holding contributor-level access or above to inject arbitrary JavaScript into pages via the 'regurl' parameter, which then executes for logged-out site visitors who load the affected page. Because the vulnerable login-form.php template branch is gated on !is_user_logged_in(), the payload only fires for anonymous traffic and never for authenticated viewers, which confines the impact despite the CVSS 6.4 score. No public exploit code has been identified and the issue is not flagged as actively exploited, so urgency is moderate and concentrated on sites that grant contributor roles or open registration to low-trust users.
Stored cross-site scripting in the Robo Gallery WordPress plugin before 5.2.6 lets authenticated users with the Contributor role or higher save unsanitized gallery settings that are later rendered on the gallery edit screen, so the injected JavaScript executes in the browser session of any administrator who opens that gallery for editing. This is a moderate, authenticated-only stored XSS (CWE-79): the attacker must already hold Contributor-level access, and the payload stays inert until a higher-privileged user interacts with the poisoned gallery (UI:R is a hard prerequisite). Publicly available exploit code exists, but there is no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available in 5.2.6; sites that do not grant Contributor+ accounts to untrusted parties face little practical exposure.
Stored cross-site scripting in the Robo Gallery WordPress plugin before version 5.2.6 allows an authenticated user holding the Author role or higher to save a crafted gallery setting that is later rendered without escaping on the frontend, so the script executes in the browser of any visitor who views the poisoned gallery - including administrators. The injection point is a gallery setting editable only by Author-and-above accounts, and the payload only fires when a victim subsequently loads the affected page, so exploitation requires an authenticated foothold plus victim page views rather than being a one-step anonymous attack. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no indication of confirmed active exploitation in CISA KEV; the vendor has released a fix in 5.2.6, and this is assessed as a moderate, not top-priority, issue.
Stored cross-site scripting in the Robo Gallery WordPress plugin (versions before 5.2.6) lets an authenticated user holding the Author role or higher plant JavaScript inside image alt text, which one gallery layout renders without sanitization or escaping, so the script executes in the browser of any visitor who views that gallery - including administrators. Exploitation requires a valid Author-level account on a site running a vulnerable version, the ability to set gallery image alt text, and use of the specific affected layout, with a separate victim having to open the gallery for the payload to fire; publicly available exploit code exists, but there is no indication of confirmed active exploitation. Severity is assessed as moderate and privilege-gated rather than remote unauthenticated code execution, and the vendor has released a fixed version.
Stored cross-site scripting in the Robo Gallery WordPress plugin before 5.2.6 lets an authenticated attacker holding the Author role or higher save a malicious payload inside one of the plugin's image settings, which the gallery page then outputs without sanitisation or escaping so the script executes in the browser of any visitor viewing that gallery - including administrators - and notably even on multisite installs where the unfiltered_html capability has been removed. Publicly available exploit code exists and the vendor has released a fix in 5.2.6. Exploitation is gated on possessing at least Author-level access and on a victim actually rendering the poisoned gallery page, so this is a moderate-risk, elevated-priority patch rather than an emergency, and sites with no untrusted Author-or-above accounts carry substantially lower practical risk.
Information disclosure in the Dokan multivendor marketplace plugin for WordPress (versions before 5.2.0) lets any authenticated vendor read the commission rate and fixed fee that the marketplace administrator configured for other vendors, simply by requesting a commission calculation for someone else's vendor identifier. The root cause is a missing ownership check (CWE-200 information exposure) on the commission-calculation feature, which is reachable by a logged-in vendor account - a low barrier on marketplaces that allow self-service vendor registration. Publicly available exploit code exists per the WPScan advisory, no CISA KEV listing has been recorded, and impact is confined to disclosure of pricing configuration: there is no data modification, privilege escalation, or service disruption. The vendor has released a fix in version 5.2.0, and the independent assessment confirms this as a genuinely low-severity issue with a consistent risk picture.
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.
Envira Gallery, a WordPress gallery plugin, fails to verify that a user is authorized to read a gallery before rendering it in versions before 1.16.2, letting an authenticated attacker with author-level publishing privileges embed another user's gallery and expose its non-public metadata to unauthenticated visitors. Publicly available exploit code exists, and the vendor has released a fix in 1.16.2. The measured risk is low (CVSS 2.7), because exploitation requires an author-level account on a multi-author site and disclosure is limited to gallery metadata rather than full account or site compromise.
Envira Gallery before 1.16.2 contains a missing authorization flaw in its gallery-conversion feature, allowing an authenticated WordPress user with contributor-level access to create and publish gallery posts that the plugin's settings would otherwise withhold from them. Publicly available exploit code exists, but impact is limited to gallery content integrity; there is no code execution, data disclosure, or site takeover, and upgrading to 1.16.2 remediates the issue.
Authenticated information disclosure in the Envira Gallery WordPress plugin affects all versions before 1.16.2, allowing any user who can create or edit a gallery - Author role and above by default - to retrieve the title and excerpt of other users' private, draft, pending, and trashed posts that WordPress would normally withhold. The flaw is a missing authorization check (CWE-200) on the image identifier supplied when adding media to a gallery, and it is rated low severity (vendor CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N; our independent assessment lowers the privilege requirement to PR:L since Author is the default capability for gallery editing). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and a vendor fix is available in version 1.16.2.
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a subscriber-level account - to invoke an AJAX action that has no capability or nonce check and make the site send arbitrary HTML email from its own mail system to arbitrary recipients. The practical impact is outbound mail relay used for phishing that carries the victim site's domain and sending reputation, with no direct data disclosure or code execution; the assessed CVSS vector (PR:L, I:L, no C/A impact) keeps this at medium severity (CVSS 4.3). Publicly available exploit code exists, and there is no KEV entry confirming active exploitation; the primary gating factor is authentication, which is trivially obtained on membership sites that permit open self-service registration.
Stored cross-site scripting in the Post Snippets WordPress plugin through 4.2.4 lets an authenticated user with Contributor-level access or above inject arbitrary JavaScript through snippet variable values, which then executes in the browser of any higher-privileged user (such as an editor or administrator) who views the rendered content. The plugin substitutes variable values into snippet output without escaping them, so injected script runs in the context of the viewing user's session and can be leveraged for session or credential theft and privileged actions performed on the victim's behalf. Publicly available exploit code exists and WPScan published the vulnerability, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV); real-world exposure is limited to sites that grant Contributor or snippet-authoring access to untrusted or lower-trust users.
Authenticated low-privilege users on WordPress/WooCommerce sites running the ALD - Dropshipping and Fulfillment for AliExpress and WooCommerce plugin (woo-alidropship) through version 2.2.4 can reach plugin functionality they are not authorized to use, because affected endpoints omit authorization/capability checks (CWE-862). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), the practical impact is limited to low-integrity modification - no confidentiality or availability loss - and exploitation requires the attacker to already hold a valid low-privilege account on the target site, so sites that do not allow untrusted user registration have sharply reduced exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and this remains a low-to-moderate priority issue rather than an emergency patch item.
Unauthenticated remote attackers can retrieve embedded sensitive system information from WordPress/WooCommerce sites running the YITH WooCommerce Product Add-Ons plugin through version 4.34.0. The flaw (CWE-497) is network-reachable with no privileges or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N, but the confidentiality impact is bounded (C:L), so exposure is limited to a specific set of sensitive data rather than a full site or database compromise, yielding a moderate CVSS 3.1 score of 5.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV signals were not provided in the source data; risk is concentrated among unpatched sites with this plugin installed and active.
Authenticated subscriber-level bypass in the VideoWhisper MicroPayments WordPress plugin (versions up to and including 3.2.9) lets a low-privilege account tamper with payment and entitlement state that should require higher privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base score 5.4) describes a network-reachable flaw that still requires the attacker to hold a subscriber account, which is the primary limiting factor: the target site must either allow subscriber self-registration or the attacker must already possess such an account. Impact is bounded to partial integrity and availability loss with no confidentiality exposure, and no public exploit code was identified at time of analysis.
An unauthenticated bypass in the 'Pay With MetaMask For WooCommerce - Cryptocurrency Payment Gateway' WordPress plugin (all versions up to and including 1.7.2) lets remote attackers circumvent the plugin's authenticity/verification checks, altering limited aspects of application state without logging in, per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Because the vector carries PR:N and UI:N, unauthenticated remote attackers can trigger the flaw on any site where the plugin is active, but the impact is confined to integrity only (I:L) with no confidentiality or availability effect, keeping this a moderate-severity issue rather than a critical one. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS signal was supplied; the affected population is limited to WordPress/WooCommerce sites running this niche cryptocurrency payment gateway.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Unauthenticated content injection in the Kutethemes 'Boutique' WordPress theme at version 2.3.3 and earlier lets remote attackers reach a shortcode-handling path and inject arbitrary content into affected sites. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any internet-facing WordPress installation with this commercial theme active is exposed by default; the attack surface is bounded to sites running this specific theme. Impact is assessed as limited content injection and partial data exposure (C:L/I:L/A:N) rather than server compromise, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in unpatched, theme-deployed sites.
Missing authorization checks in the Upcasted S3 Offload plugin (published as 'AWS S3 for WordPress Plugin - Upcasted') through version 3.1.0 let any authenticated user holding only the Subscriber role invoke plugin functionality that should be reserved for higher-privileged accounts, yielding limited confidentiality, integrity, and availability impact rather than full site takeover. The attack is network-reachable and requires no user interaction, but the PR:L rating means an attacker must first possess a valid low-privilege WordPress account - most commonly obtained through open or self-service user registration - which is the principal limiting factor on real-world exposure. There is no public exploit code identified at time of analysis and no indication of active exploitation, and the moderate CVSS score of 6.3 reflects the constrained, low-impact actions that the missing check exposes.
Unauthenticated sensitive data exposure in the WordPress plugin Swish Migrate and Backup (versions 1.4.0 and earlier) lets remote attackers retrieve data the plugin should have kept private, with the impact confined to confidentiality (CVSS 5.9, C:H/I:N/A:N). Exploitation is not trivial: the CVSS vector (AV:N/AC:H/PR:N/UI:N) marks high attack complexity, meaning a specific transient or plugin-operation condition - such as a backup or migration in progress, or an exposed backup artifact - must be met before the leak occurs, and the available data does not identify the exact trigger. At time of analysis no public exploit code has been identified, the issue was reported by Patchstack, and it is a moderate-priority information disclosure rather than a top-tier emergency; the niche deployment of this plugin further limits realistic exploitation.
Missing authorization checks in the Jetpack VideoPress WordPress plugin versions 3.6 and earlier let an authenticated Subscriber-level account perform actions that should be limited to higher-privileged users, giving a low-privileged attacker the ability to modify data (integrity impact only, with no confidentiality or availability effect per the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5). Sites are exposed if they run an affected plugin version and allow the attacker to obtain a Subscriber account, which is trivial on installations with open user registration enabled; fully unauthenticated attackers cannot exploit the flaw. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority hardening item rather than an emergency, though the absence of a named vulnerable endpoint in the published advisory makes the true reachable surface hard to bound.
Trusted-credential abuse in CodePeople2 Sell Downloads (WordPress plugin) up to version 1.2.3 allows unauthenticated remote attackers to bypass origin verification and access or modify limited data, such as download or order metadata. The flaw, tracked as CVE-2026-94590, has a CVSS score of 6.5 and is not known to be actively exploited; no public exploit code has been identified. Only WordPress sites with this specific, low-prevalence plugin active are affected, making the real-world risk moderate and low-priority.
Missing authorization in VillaTheme GIFT4U (gift4u-gift-cards-all-in-one-for-woo) versions 1.1.3 and earlier allows unauthenticated remote attackers to tamper with limited gift-card-related data on WordPress/WooCommerce sites where the plugin is active. The flaw (CWE-862) stems from the plugin failing to enforce an access-control check on a restricted function, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to integrity (VI:L) with no confidentiality or availability impact, resulting in a medium-severity rating.
Unauthenticated remote attackers can retrieve embedded sensitive information from WordPress sites running the WP Rollback plugin through version 3.1.2, because the plugin places sensitive data into data it sends back to the client (CWE-201). The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are needed but attack complexity is high, so success depends on conditions the attacker does not control - such as the specific sensitive data being present in the affected responses or a particular plugin state. There is no public exploit code identified at time of analysis and no confirmation of active exploitation (CISA KEV); the exposure is limited to confidentiality, with no integrity or availability impact, and the exact data exposed is not described in the available advisory and should be confirmed with the vendor/Patchstack.
Stored cross-site scripting in the PeproDev Ultimate Profile Solutions WordPress plugin (all versions up to and including 8.2.36) allows an authenticated attacker holding contributor-level privileges or higher to inject arbitrary JavaScript into a page via the 'button' attribute of the shortcode, which is stored without sanitization and rendered without output escaping. The payload executes in the browser of any user who later views the injected page, and because the injected content lives in persistent post data it can trigger against administrators and other privileged viewers. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this should be treated as a moderate-priority issue rather than an emergency.
Arbitrary file deletion in the WordPress plugin Listdom: AI-powered Business Directory with Classifieds Ads Listings (all versions up to and including 6.1.2) lets an authenticated administrator delete files anywhere on the server by supplying a traversal path to the plugin's CSV import routine (LSD_Menus_IX_CSV::import). The practical impact is high for integrity and availability - deleting a sensitive file such as wp-config.php can drop the site into a re-installation state and enable full takeover/RCE - but the requirement for administrator-level access (CVSS PR:H) makes this a high-barrier, medium-severity issue rather than a widespread emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in Premium Packages - Sell Digital Products Securely (wpdm-premium-packages) through version 7.2.6 lets authenticated attackers with subscriber-level access or above inject arbitrary web scripts into checkout billing fields such as phone, state, taxid, and email, which are then rendered in the customer dashboard without adequate escaping. The issue is rated CVSS 6.4 Medium and requires an account on the target WordPress site, but exploitation does not require administrative privileges; script execution occurs when a higher-privileged user views the poisoned billing information. No public exploit has been identified at time of analysis, and the primary fix is an upstream changeset rather than a confirmed tagged patched release.
Stored cross-site scripting in the Avada theme for WordPress (versions up to and including 7.16.1) allows authenticated attackers with Subscriber-level access or higher to inject javascript: URLs into author social link profile fields, which execute when a victim visits the attacker's author archive page and clicks the affected social icon. Exploitation is constrained by required user interaction and by the Avada option 'Open Social Icons in a New Window' being set to Off so the browser does not block the javascript: URL in a new tab. This is a moderate-severity issue (CVSS 6.4) that does not rise to emergency priority, and no public exploit was identified at time of analysis.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored DOM-based cross-site scripting in the SureDash - Community, Courses & Member Dashboard plugin for WordPress (all versions up to and including 1.12.1) allows authenticated attackers with subscriber-level access or above to plant arbitrary script inside community post content by entity-encoding a payload in an image's 'alt' attribute. The payload evades server-side wp_kses filtering because kses allows the img/alt combination and does not normalize HTML entities within attribute values, and it only executes client-side when the bundled GLightbox library reads the .alt DOM property and writes the decoded value into innerHTML as a victim views the injected page. There is no public exploit identified at time of analysis, and exploitation demands a valid low-privilege account plus an active community/GLightbox rendering path, so this is a genuine but moderate-priority issue rather than a top-tier emergency; the vendor has released SureDash 1.12.2 to address it.
Authenticated subscribers (or any logged-in user) on WordPress sites running the AutomatorWP plugin up to and including 5.8.4 can enumerate Fluent Forms records - specifically form IDs and titles from the fluentform_forms database table - because a plugin AJAX handler performs no authorization check. The flaw is network-reachable but requires a valid low-privilege account plus the Fluent Forms plugin and AutomatorWP's Fluent Forms integration to be active, and exposure is limited to form identifiers and titles rather than submissions or configuration data (CVSS 4.3, CWE-862). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); overall this is a genuinely low-priority information-disclosure defect.
Time-based blind SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.9) allows authenticated attackers holding subscriber-level access or above to append extra SQL into an existing query and read sensitive information from the site database. The issue is second-order: a subscriber stores a display_name value containing a single quote, which WordPress preserves verbatim, and the payload only fires later when WdkCachedUserEditor::update_listings_user_editor() re-reads that cached value into the SQL sink without escaping or prepared-statement parameterization. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the impact is confidentiality-only and blind, so exfiltration is slow and generates measurable request volume; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting (XSS) in the Retainful Email Marketing for WordPress and WooCommerce plugin (versions ≤1.0.10) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'data' parameter in the plugin's REST API, which execute when a victim views the affected page. This vulnerability requires a low-privilege account and user interaction, and no public exploit code or active exploitation has been identified. It is a moderate-severity (CVSS 6.4) issue that should be patched promptly.
Reflected cross-site scripting in WPForms Lite through 2.0.2.1 allows an unauthenticated attacker to execute arbitrary script in a victim's browser if the site administrator previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page. The attacker must trick a victim into clicking a crafted link containing a malicious value for the referenced query parameter, and the flaw is rated CVSS 4.7 with high attack complexity and required user interaction. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Stored cross-site scripting in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to and including 1.4.123) allows authenticated attackers with Subscriber-level access to inject arbitrary web scripts via the 'stm_f_s' parameter. The CSRF nonce protecting the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, so any logged-in user can retrieve it, removing the usual barrier to exploitation. This is a moderate-risk issue (CVSS 6.4) and no public exploit has been identified at the time of analysis.
Stored cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.8.4) lets an attacker persist arbitrary JavaScript through the member profile 'country' field, which then executes in the browser of any user - typically an administrator - who views the affected member listing or profile page. By default the attacker must hold an authenticated account at subscriber level or above, but the vector widens to fully unauthenticated attackers whenever the plugin's 'Enable Free Membership' option is on, because that setting permits anonymous front-end registration and profile submission. Rated CVSS 6.4 (Medium) and reported by Wordfence, there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the fix is the vendor-released version 4.8.5.
Sensitive information exposure in the SpeedyCache - Cache, Optimization, Performance WordPress plugin through version 1.4.2 allows an unauthenticated attacker to read the full name and email address of returning commenters by fetching a publicly cached page whose personalized comment-form prefill was written into the site-wide cache. The root problem is asymmetric handling of WordPress commenter cookies: advanced-cache.php suppresses cached delivery on the read path for requests carrying comment_author_* / comment_author_email_* cookies, but the equivalent check is missing on the write path in cache.php, so the personalized render is still stored under the public URL and can be retrieved by any cookie-less attacker who requests that same URL before the entry is regenerated. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), it leaks only the identity of whichever commenter's render happened to be cached; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated arbitrary file upload in WP CV Builder plugin versions up to and including 1.3.1 allows remote attackers to write arbitrary content as .png files to the WordPress uploads directory via the 'wp_save_signature_image' function, which lacks a capability check. This integrity-only primitive requires no authentication and affects default installations, but does not directly enable code execution. No public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Team - Team Members Showcase (slug 'tlp-team', vendor techlabpro1) affects all versions up to and including 6.0.2 and lets authenticated attackers with contributor-level privileges or above persist arbitrary JavaScript via the 'ttp_filter_taxonomy' taxonomy-meta value of an attacker-chosen post. The script then executes in the browser of any user - including higher-privileged users such as editors or administrators - who views a page where the plugin's shortcode renders that taxonomy filter output, giving a CVSS 6.4 impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation, so risk is concentrated on sites that grant contributor access to untrusted users; there is no unauthenticated path (PR:L).
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin through version 3.28.36 lets authenticated users with Contributor-level or higher access inject arbitrary web scripts by exploiting a kses/mutation-XSS bypass in the get_dynamic_values function, which performs text-level find-and-replace on post content without HTML-aware parsing. The stored payload executes when another user views the affected page, and the CVE carries a CVSS 3.1 score of 6.4 with scope change. This is a moderate-priority issue rather than a top-tier emergency, and no public exploit identified at time of analysis; practical risk is limited to sites that grant untrusted users Contributor-or-higher roles and have the plugin active.
Reflected cross-site scripting in the Favicon Rotator plugin for WordPress (all versions up to and including 1.2.11) allows unauthenticated attackers to inject arbitrary JavaScript through any request parameter prefixed with 'fvrt_', which the plugin reflects back into a page without adequate sanitization or output escaping. Exploitation is not direct: because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, the attacker must deliver a crafted link and convince a victim to click it, after which the script executes only in that victim's browser, potentially stealing session data, altering page content, or acting as the victim - with an administrator victim yielding the greatest impact. This is a moderate-severity reflected XSS that warrants routine, lower-priority patching; no public exploit code was identified at time of analysis, and the vendor's 1.2.12 release addresses the flaw.
Authenticated SQL injection in WP Booking System - Booking Calendar versions up to and including 2.1.0.1 allows subscriber-level attackers to extract sensitive database information via the 'current_month' parameter. The vulnerability is a regression: a capability check added in 2.0.19.11-2.0.19.14 to fix CVE-2024-50425 was removed in version 2.1, and no nonce validation is required, so any logged-in subscriber can reach the vulnerable AJAX handler. No public exploit code or active exploitation has been identified at time of analysis, and the assessed severity is moderate (CVSS 6.5).
Stored cross-site scripting in the Responsive Lightbox & Gallery WordPress plugin (all versions through 2.7.9) lets authenticated attackers with editor-level privileges or higher inject arbitrary web scripts through the 'comment' parameter, which then execute when a site visitor opens the lightbox on an affected image. Realistic exploitation is heavily constrained by stacked prerequisites: the plugin's 'Comments' lightbox setting must be explicitly enabled (it is off by default), a moderator must approve the injected comment, the attacker must already hold a high-privilege account, and a visitor must click the affected image - which is why this is assessed as a low-priority issue despite the network attack vector. No public exploit code has been identified at the time of analysis and the flaw is not listed in CISA KEV; the CVSS 3.1 base score is 4.4 (assessed vector AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).
Reflected cross-site scripting (XSS) in the Payment Plugins for Stripe WooCommerce WordPress plugin, affecting all versions up to and including 4.0.17, enables unauthenticated attackers to inject arbitrary web scripts through the '#response' URL fragment when a victim opens a crafted link. Exploitation is further conditional on the plugin's 'Generic Errors' setting being unchecked, which causes raw Stripe error strings to be reflected into the page; there is no public exploit identified at time of analysis and no CISA KEV listing. The vendor-provided CVSS 3.1 score is 6.1 (moderate), and the independent assessment raises attack complexity to High given the required non-default configuration and mandatory user interaction.
Authenticated directory traversal in the SiteOrigin Widgets Bundle WordPress plugin (all versions up to and including 1.74.3) allows contributor-level users and above to read arbitrary files on the server through the get_instance_css function, exposing sensitive data such as wp-config.php secrets. Exploitation requires only a low-privilege contributor account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), needs no user interaction, and is limited to read-only information disclosure with no direct write or code-execution impact; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited. Overall this is a credible but moderate-priority issue rather than a top-tier emergency, with risk concentrated on sites that grant contributor access broadly.
Stored cross-site scripting in the WP User Frontend WordPress plugin (all versions up to and including 4.3.12) allows any authenticated user with subscriber-level access or higher to persist arbitrary JavaScript that executes when a privileged user - typically an administrator - opens the affected transactions page. The root cause is insufficient sanitization and output escaping of the 'wpuf_payment_method' parameter: attackers bypass sanitize_text_field() by appending a valid gateway keyword such as 'bank' to the HTML payload, so the filter returns only the keyword for gateway routing while the full raw malicious value is stored and later rendered unescaped in the admin transactions list. Wordfence reported the issue with a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis, and there is no confirmed evidence of active exploitation (no CISA KEV listing).
Fluent Forms for WordPress (all versions up to and including 6.2.5) fails to verify that a user is authorized before performing several form-management actions, allowing an authenticated attacker holding Custom-level access or above to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings. The flaw is a missing-authorization issue (CWE-862) reachable over the network with low complexity and no user interaction once a qualifying account exists, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) reflects limited confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the practical exposure is concentrated in multi-user sites that provision low-privilege or custom roles.
Broken access control in the Tutor LMS WordPress plugin before 4.1.1 lets an authenticated user with instructor-level privileges reassign the parent of arbitrary posts on the site, allowing them to absorb other instructors' course content into their own courses and to orphan legitimate published content so it becomes unreachable. The root issue is an insecure direct object reference (CWE-639) in the plugin's course content ordering handler, which never verifies that the posts named in the request belong to a course the requester manages. No public exploit code has been identified at time of analysis, and the practical risk is confined to multi-instructor deployments that hand instructor roles to semi-trusted or self-registered users; the vendor has released a fix in Tutor LMS 4.1.1.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin before 1.3.6 allows authenticated users with Contributor-level access or higher to save JavaScript into one of the plugin's gallery settings, which is then written into an HTML attribute without sanitization or escaping, so the payload executes in the browser of any user - including an administrator - who views a page containing the gallery. Exploitation is not self-triggering: an attacker needs at least a Contributor account plus a victim who loads the affected page (UI:R), and sites that do not grant untrusted users posting roles are largely unaffected. No public exploit code has been identified at time of analysis and no EPSS score was supplied in the available intelligence; the vendor has released a fix, and our independent reassessment rates the issue MEDIUM (CVSS 3.1 base reflecting PR:L, S:C, C:L/I:L/A:N), which is lower in privilege prerequisite but broader in scope than NVD's published 6.8 vector.
WordPress sites running the W3 Total Cache plugin before 2.10.6 let an authenticated user with the Author role or higher plant media-import content that, once an administrator executes the plugin's import action, copies an arbitrary server-readable file - such as wp-config.php or a backup/credential file - into a publicly served directory where it can be fetched without authentication. The defect is a path-traversal / missing file-type restriction issue (CWE-22) rated 5.4 (medium) under CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N, yielding read-only information disclosure with no integrity or availability impact. A vendor patch is available in 2.10.6, no public exploit code has been identified at time of analysis, and because the attack cannot be completed alone - a privileged administrator must trigger the import, and the target file must be readable by the web-server process - practical priority is moderate rather than urgent.
Unrestricted brute-forcing of the email-verification PIN in the Contest Gallery WordPress plugin (all versions before 33.0.1) lets unauthenticated attackers guess a short numeric code and complete front-end registration for an email address they do not own, resulting in an authenticated WordPress session that the plugin treats as verified. Exploitation requires that the plugin's public front-end registration with email verification be enabled, and the practical ceiling is the privilege level the plugin assigns to self-registered accounts - typically low-privilege - rather than administrative access, which keeps this a genuine but moderate-severity authentication weakness rather than a critical one. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); the vendor has released a fix in version 33.0.1.
Unauthenticated information disclosure in the Booking Package WordPress plugin before 1.7.30 lets remote attackers retrieve other customers' stored reservation details and booking cancellation tokens because the data-returning endpoint omits authorization checks. Any WordPress site running the affected plugin with stored reservations is exposed over the network without credentials, though impact is confined to confidentiality and availability/integrity are unaffected (CVSS 5.3, CWE-200). No public exploit code or confirmed active exploitation was identified in the available intelligence.
Unauthenticated information disclosure in the WordPress plugin 'Accept PayPal Payments using Contact Form 7' (all versions before 4.0.7) allows any remote visitor to download the stored form submissions - name, email, telephone, postal address, message and associated payment metadata - of every person who submitted a payment form. The plugin's export routine performs no authorization check whatsoever, so exploitation requires no account, no user interaction and no non-default configuration; the only practical preconditions are that the plugin is installed and that at least one submission has been stored. Our independent assessment rates confidentiality impact as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) rather than the feed-supplied C:L, and no public exploit code or confirmed active exploitation has been identified at time of analysis; a vendor fix is available in version 4.0.7.
Unauthenticated attackers can forge stored transaction statuses and inject the Accept PayPal Payments using Contact Form 7 plugin's status metadata onto arbitrary WordPress posts, affecting all versions of the plugin prior to 4.0.7. The flaw (CVE-2026-105989, CVSS 5.3, CWE-862 Missing Authorization) stems from an AJAX action that ships without any authorization or nonce/request-validation check, so it is reachable by remote unauthenticated requests against default installations with the plugin active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. Impact is confined to integrity (C:N/I:L/A:N), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated users with Contributor role or higher can permanently delete media attachments owned by other users, including administrators, in Portfolio Filter Gallery versions 2.0.2 through before 2.2.1 due to a missing per-object authorization check in the plugin's attachment deletion handler. The vendor has released patch version 2.2.1; no public exploit code is identified at time of analysis. This is a low-priority, defense-in-depth issue per independent assessment, with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, relevant primarily to multi-author or open-registration WordPress sites.
Authenticated attackers with Contributor-level access can exploit missing authorization checks in the Portfolio Filter Gallery WordPress plugin (versions before 2.2.1) to read, modify, and delete other users' galleries and site-wide gallery filters. This is a moderate-severity issue (CVSS 4.7) requiring a valid low-privileged account; no public exploit identified at time of analysis. A vendor patch is available in version 2.2.1.
Stored cross-site scripting in the Rank Math SEO WordPress plugin before 1.0.280 allows an account that can manage redirections (Administrators by default) to persist JavaScript in a redirection source value that then executes in the browser session of any user who opens the redirections administrative list view, including a Super Administrator on a multisite install. Exploitation requires a high-privileged authenticated account plus victim interaction (someone must open the affected admin view), and the impact is bounded to limited confidentiality and integrity loss, giving a low CVSS 3.1 base score of 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
SQL injection in Rank Math SEO before 1.0.280 allows an authenticated high-privilege user, such as an administrator, to inject arbitrary SQL through an unsanitized parameter, potentially reading limited data from the WordPress database. The requirement for administrator-level access (CVSS PR:H) sharply limits realistic risk; no public exploit was identified at time of analysis, and the issue is assessed as low priority despite network exploitability. A vendor patch is available in version 1.0.280.
Reflected cross-site scripting in the WordPress Download Manager plugin (codename065, all versions up to and including 3.3.57) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they load a crafted link containing a malicious payload in the 'REFERRER' parameter. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no authentication is required but a successful attack depends on victim interaction, making phishing or social-engineering delivery the realistic path rather than silent mass exploitation; the scope is changed (S:C), so script execution can reach beyond the plugin's own page context. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is best treated as a moderate-severity, high-prevalence-product hygiene fix rather than an emergency.
Stored cross-site scripting in the Graphene theme for WordPress through version 2.9.4 allows any authenticated user holding Subscriber-level access or above to plant persistent JavaScript in the theme's 'Current location' and 'Author profile image URL' profile fields, which then executes in the browser of every user who loads a page rendering that author data - including administrators. The flaw stems from insufficient input sanitization and output escaping (CWE-79) and was reported by Wordfence; the CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting that the attacker needs only a low-privilege account but the injected script can run in a scope beyond the vulnerable component. There is no KEV listing and no public exploit code identified at time of analysis, and the fixes appear in the WordPress theme Trac changesets comparing 2.9.4 against 2.9.6.
Stored cross-site scripting in the Brizy - Page Builder WordPress plugin, affecting all versions up to and including 2.8.18, lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through the 'brizy-compiled-sections' parameter when creating or editing page content. Because the payload is persisted and rendered without adequate escaping, the script executes in the browser of any user - including higher-privileged editors or administrators - who subsequently views the injected page, and the CVSS scope-change (S:C) reflects that the code runs in the victim's session context rather than the attacker's. Rated CVSS 6.4 and reported by Wordfence, there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, making this a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Stored cross-site scripting (XSS) in the Noptin Newsletter WordPress plugin up to version 4.3.10 allows unauthenticated attackers to inject malicious scripts that execute in the browser of a privileged user. Exploitation requires a published campaign post containing a [[subscriber.*]] merge tag and social engineering of an admin to visit a crafted preview URL; the independent assessment rates this as medium severity (CVSS 5.4) with high attack complexity and required user interaction. No public exploit identified at time of analysis.
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
Stored cross-site scripting in the GiveWP donation and fundraising plugin for WordPress (versions up to and including 4.17.0) lets authenticated attackers with Contributor-level access or above plant arbitrary JavaScript through the givewp_campaign_grid shortcode's attributes, which is then rendered unsanitized into any page or preview that loads the affected content. Exploitation requires a low-privileged account able to submit shortcode-bearing content and a higher-privileged or public visitor to view it, which is why it rates only moderate (CVSS 6.4, scope-changed C:L/I:L) and is a realistically lower-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing). The primary impact is session/token theft or privileged action abuse against the viewing user rather than site-wide compromise.
Stored cross-site scripting in the Kadence Blocks - Page Builder Toolkit for Gutenberg Editor WordPress plugin affects all versions up to and including 3.7.12, allowing an authenticated attacker holding author-level privileges or higher to inject arbitrary web scripts through a block's font-family attribute that execute when a victim views the injected page. The payload path is conditional: the malicious font-family encoding bypass only activates when the non-default 'Load Google Fonts Locally' site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, so default-configured sites are not exploitable through this vector. Exploitation additionally requires a victim to later access the poisoned page, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate, conditionally-exploitable issue rather than a top-tier priority given the privileged account requirement, the non-default setting, and the necessary victim interaction.
Stored cross-site scripting in the Embed Any Document WordPress plugin (all versions through 2.7.13) lets authenticated users with contributor-level access or above plant arbitrary JavaScript in post content through the plugin's 'embeddoc' shortcode; the script lies dormant until any visitor - commonly a higher-privileged editor or administrator reviewing the page - loads the affected content. The issue carries a CVSS 3.1 score of 6.4 (medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N that confirms remote reachability but an authenticated (PR:L) prerequisite and a scope change indicating execution in the context of the site. No public exploit code identified at time of analysis, and real-world exposure is limited to sites that run the vulnerable plugin, permit the 'embeddoc' shortcode in author-controllable content, and grant contributor accounts to untrusted parties.
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Stored cross-site scripting in the Church Admin plugin for WordPress (all versions up to and including 5.1.2) lets an authenticated attacker with subscriber-level access or above inject arbitrary script through the plugin's 'email' parameter, which is neither sanitized on input nor escaped on output. The injected payload persists in the database and executes in the browser of any user who later views the affected page - typically an administrator or other privileged staff member reviewing church member records - making it a low-complexity path from a throwaway subscriber account to privileged session compromise. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); with a CVSS base of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this should be treated as a patch-when-convenient issue rather than an emergency. Sites that permit open self-registration are meaningfully more exposed, since the attacker must first hold a valid low-privilege account.
Unauthenticated attackers can download exported WooCommerce order CSV files containing customer PII from sites using the WebToffee Order Export & Order Import plugin versions up to 2.7.8, but only when the wp-content/webtoffee_export/ directory lacks its .htaccess and index.php guard files-a state that can arise after uninstall/reinstall, migration, backup restore, or staging sync. The vulnerability (CWE-552) is rated moderate (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because exploitation additionally requires knowledge or brute-forcing of second-precision timestamp filenames; no public exploit code has been identified at time of analysis. The vendor has released version 2.7.9, which the referenced code changes suggest addresses the issue.
Stored cross-site scripting in the HivePress WordPress plugin (Business Directory, Listings & Classified Ads) affects all versions up to and including 1.7.31 and allows authenticated users with subscriber-level accounts or higher to inject arbitrary JavaScript that executes when other users view the affected listing page. Exploitation is conditional, not universal: the site must permit subscriber-level registration or listing submission, and an administrator must have configured a HivePress Text attribute whose display format places the %value% token inside an HTML attribute (for example title="%value%"), which is a documented but non-default HivePress pattern - a default configuration that renders %value% as normal element text is not exploitable. The vendor has released 1.7.32, which includes the fix for escaping field and token values; no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). Independent assessment rates the practical severity as moderate and conditionally exploitable, with attack complexity assessed as High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than the published AC:L rating.
Authenticated directory traversal in the Post Export Import with Media plugin for WordPress through 1.17.1 allows administrator-level users to read arbitrary files from the server by importing a crafted ZIP whose media_metadata.json file_path field contains traversal sequences while the destination filename uses an allowed extension. Although rated CVSS 4.9, real-world priority is materially reduced because the vector requires PR:H, meaning the attacker already holds WordPress administrator credentials; impact is read-only confidentiality disclosure with no integrity or availability effect. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Stored cross-site scripting in the GamiPress WordPress gamification plugin (all versions up to and including 7.9.4) allows any authenticated user with subscriber-level access or higher to inject arbitrary JavaScript through the 'video_id' parameter processed by the plugin's YouTube integration, which then executes in the browser of any user viewing the poisoned page. Exploitation requires a valid low-privilege account on the affected site plus a victim loading the injected content; the impact is most serious when the victim is an administrator, since the script runs in the site's origin and can be used to hijack sessions or perform privileged actions. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-severity (CVSS 6.4) but credible priority for sites that allow open registration and use the YouTube integration.
Stored cross-site scripting in the Sonaar MP3 Audio Player - Music Player, Podcast Player & Radio plugin for WordPress (all versions up to and including 5.14.2) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript through the plugin's shortcode attributes, which then executes in the browser of any user who later loads the affected page. The payload survives WordPress's save-time wp_kses_post sanitization because it is carried in a shortcode attribute rather than raw post HTML, so the unescaped value reaches render time intact. The flaw is authentication-gated and rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis; there is no CISA KEV listing for this CVE.
Authenticated users with subscriber-level access or higher can alter site-wide semantic search configuration in the WordPress plugin AI Puffer (formerly AI Power) when an administrator has already granted their role the Knowledge Base ('sources') module through the plugin's Role Manager. The flaw affects all versions up to and including 2.4.89 and allows an attacker to change global values in the aipkit_options record - vector provider, embedding provider, embedding model, target ID, result count, and no-results text - that are otherwise administrator-only, giving a limited integrity impact with no confidentiality or availability loss. Exploitation requires a non-default role grant, so reachability is constrained; there is no public exploit and no confirmed active exploitation (no CISA KEV listing) at time of analysis, and the CVSS 3.1 vector scores this as low severity (3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
Authorization bypass in the WordPress plugin AI Puffer - Chat. Create. Automate. (formerly AI Power, slug gpt3-ai-content-generator) through version 2.4.89 lets an authenticated subscriber-level user rewrite the global options aipkit_training_general_settings and aipkit_indexing_field_settings, changing chunking parameters, file upload visibility and per-post-type field indexing for the whole site. Exploitation is tightly constrained: the attacker must already hold an account (PR:L per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) and an administrator must have explicitly granted the 'sources' module to that lower-privileged role through the plugin's Role Manager, a non-default configuration against which the plugin is not exploitable at all, which is why attack complexity is rated High. Impact is confined to configuration integrity with no data disclosure or availability loss, no public exploit identified at time of analysis, and this is assessed as a genuinely low-priority issue.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin, all versions up to and including 1.3.35) lets an authenticated attacker holding Contributor-level privileges or higher inject arbitrary JavaScript through table cell content, which then executes in the browser of any user who later views the affected page. The flaw is a classic CWE-79 defect: cell content is insufficiently sanitized on input and insufficiently escaped on output, so payloads persist in post data and are served back to victims. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with scope change because the script runs in the security context of the site and can reach higher-privileged viewers; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.
SQL injection in the 'sidx' parameter of the Smart Popup by Supsystic WordPress plugin (all versions up to and including 1.13.2) lets authenticated attackers with administrator-level privileges append arbitrary SQL statements to existing queries and extract sensitive data from the site's database. The CVSS vector confirms high privileges are required (PR:H) and impact is limited to confidentiality (C:H/I:N/A:N), and no public exploit or CISA KEV entry has been recorded - no public exploit identified at time of analysis - so despite a CVSS base score of 4.9 this is a low real-world-priority issue because an attacker must already hold the broad database and site access that administrators legitimately possess. Affected deployments are those running 1.13.2 or earlier; the vendor released 1.13.3 to remediate it.
Sensitive customer records - booking names, email addresses, and phone numbers - can be pulled without authentication from any WordPress site running the Booking Calendar plugin through version 11.4.3, because the wpbc_is_show_popover_in_flex_timeline() function returns booking data without an authorization check. The flaw is reachable against default installations over the network with no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 5.3 Medium), and its only prerequisite is that the site already holds bookings containing PII; sites with no bookings leak nothing. Impact is confined to confidentiality (C:L) with no write, code-execution, or availability effect, no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading beyond 11.4.3 removes the exposure.
Missing authorization in the LatePoint Appointment Booking plugin for WordPress (versions up to and including 5.7.2) allows unauthenticated attackers to create approved appointments against other customers' order items by sending a non-empty params[presets][order_item_id] to the publicly reachable steps__start and steps__load_step routes. The plugin's is_bundle_scheduling() discriminator is only an !empty(order_item_id) truthiness check, so supplying any value causes the booking flow to strip out the customer and payment steps and to skip ownership, bundle-membership, paid-status, and remaining-capacity validation. Successful requests leak the targeted customer's name, email address, and order code in the booking confirmation; exploitation is limited in practice by the need to know or guess a valid order item ID of a victim. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress Download Manager plugin (codename065, versions up to and including 3.3.58) lets authenticated attackers with Contributor-level access or higher inject arbitrary JavaScript through the 'not_found' parameter processed by the plugin's shortcode handler; the stored script then runs in the browser of any user who views the injected page. The flaw is rooted in insufficient input sanitization and output escaping (CWE-79), has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and is corrected in version 3.3.59. Unauthenticated and Subscriber-only users cannot trigger it, and no public exploit code was identified at time of analysis.
Authenticated SQL injection in the FireBox - WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress (all versions up to and including 3.1.13) lets a user holding the edit_fireboxes capability append arbitrary SQL to the plugin's Form Display Condition query and read sensitive data from the site database. Because the preserveCampaignRoleAccess() migration on sites upgraded from before 3.1.10 grants edit_fireboxes to any role that previously held edit_posts, exploitation is possible at Author level on upgraded installations, while fresh installs from 3.1.10 onward require administrator access. The issue is rated CVSS 5.3 (AC:H, PR:L, confidentiality-only) and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48) allows unauthenticated attackers to inject arbitrary web scripts via the 'inputs' array key parameter. Exploitation requires tricking a user into clicking a crafted link while a vulnerable form page is reachable; the impact escalates if an authenticated administrator is the victim. No public exploit identified at time of analysis, and the vendor released a patch in version 1.15.49.
Stored cross-site scripting in the CleanTalk Anti-Spam WordPress plugin (versions up to and including 6.88) allows unauthenticated attackers to inject malicious scripts into comment fields, which then execute for any visitor viewing the affected page. Exploitation requires the attacker to first get one comment approved from their email address; default WordPress auto-approval then allows subsequent comments to store the payload without moderation. No public exploit code or active exploitation is identified at time of analysis, and the issue is rated CVSS 5.4 Medium (CWE-79).
Incorrect authorization in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.11.11) allows unauthenticated attackers who possess a valid per-appointment booking token to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. The weakness is a business-logic authorization flaw (CWE-863) confined to appointment records: it grants no server access, no data disclosure, and no code execution, which is why it carries a moderate CVSS score of 5.3 (integrity-only, low impact). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though sites that rely on the plugin's payment-confirmation or service-assignment fields (for example, paid bookings) face the greatest practical exposure.
Stored cross-site scripting in the Feedzy RSS Aggregator WordPress plugin (all versions up to and including 5.2.10) lets an authenticated attacker with contributor-level access or above inject arbitrary JavaScript into pages by pointing the Gutenberg Feedzy Loop Block at an attacker-controlled RSS feed whose <title> element contains malicious HTML, which is then rendered into the page without escaping. Because post_content stores only a benign reference to the external feed URL, the payload evades save-time wp_kses filtering entirely and executes for any user who views the affected page. Exploitation requires a contributor account, the Loop Block in use, and attacker control of an external feed; no public exploit code has been identified at time of analysis and the plugin is not listed in CISA KEV, so risk is bounded by these preconditions rather than by the network-facing vector (CVSS 6.4).
Sensitive information exposure in the WordPress Download Manager plugin (codename065) through version 3.3.71 lets an authenticated subscriber-level user harvest the administrator's full Cookie header - including wordpress_logged_in_* session cookies - by abusing the 'first_name' parameter when the administrator triggers the plugin's 'Suspend' action against the attacker's account. Because the suspension email is compiled and sent synchronously inside the administrator's own authenticated HTTP request, the site's email template engine can resolve the admin's request context (Cookie header) at send time and inject it into the outgoing message, enabling session hijack and full account takeover once the attacker reads that email. Exploitation is not fully attacker-controlled: it depends on an administrator performing the Suspend action while authenticated, so the plugin carries a CVSS 3.1 base of 4.3 (independent assessment: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting in the Filter Everything - WordPress & WooCommerce Filters plugin (versions up to and including 1.9.6) lets unauthenticated remote attackers inject arbitrary web scripts via the flrt_elementor_load_more_anchor() output, which execute when a victim clicks a crafted link that reaches the Elementor load-more code path. The flaw is rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N and requires both victim interaction (UI:R) and the Elementor-integrated load-more/AJAX filtering feature to be reachable on the target page; no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Authorization bypass in the Hello Plus plugin for WordPress (all versions up to and including 1.7.7) allows authenticated users holding Contributor-level privileges or higher to publish their own Hello+ header/footer templates and to draft active templates belonging to higher-privileged users. The plugin's template-parts actions do not verify that the caller is authorized to publish or modify those documents, so the flaw is an integrity and availability problem rather than a data-disclosure one. Exploitation requires a valid low-privileged WordPress account, making multi-author sites and sites that allow Contributor-level self-registration the primary exposure; no public exploit code has been identified at time of analysis and there is no indication of active exploitation.
Stored cross-site scripting in the Download Manager WordPress plugin (all versions up to and including 3.3.71) allows an authenticated attacker holding contributor-level access or above to inject arbitrary JavaScript into pages via the 'regurl' parameter, which then executes for logged-out site visitors who load the affected page. Because the vulnerable login-form.php template branch is gated on !is_user_logged_in(), the payload only fires for anonymous traffic and never for authenticated viewers, which confines the impact despite the CVSS 6.4 score. No public exploit code has been identified and the issue is not flagged as actively exploited, so urgency is moderate and concentrated on sites that grant contributor roles or open registration to low-trust users.