WordPress
Monthly
Reflected cross-site scripting in the Fluent Forms WordPress plugin (all versions up to and including 6.2.14) allows unauthenticated attackers to inject arbitrary script into pages via a crafted query parameter that is substituted into a {get.NAME} SmartCode. Exploitation is not possible on a default install: a site administrator must first have placed a {get.*} SmartCode inside a URL-accepting attribute (such as an iframe src or anchor href) within a Custom HTML field on a published form, and a victim with a session on the site must then be tricked into clicking an attacker-supplied link. No public exploit identified at time of analysis, and the issue is a genuine-but-moderate-priority problem rather than a drop-everything emergency given the non-default configuration prerequisite and the AC:H/UI:R scoring.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.188) allows authenticated users with subscriber-level access or above to plant arbitrary JavaScript in listing data via the 'Contact Email' custom field, which then executes in the browser of anyone viewing the affected public single-listing page. Exploitation is not a default-configuration issue: the site administrator must first have added and configured the Contact Email custom field (htmlvar_name 'email') to render on public single-listing output and must subsequently approve the attacker's submitted listing before the payload becomes live, which is why the independent assessment rates the vector AC:H and describes this as conditionally exploitable rather than broadly reachable. There is no public exploit code or confirmed active exploitation at time of analysis, and no EPSS or KEV signal accompanies this record; residual risk is concentrated in sites that permit low-privilege registration, accept untrusted listing submissions, and expose the Contact Email field publicly.
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.
Unauthenticated attackers who already know a registered customer's primary phone number or email can read that customer's stored name, email, phone and internal notes from WordPress sites running the Bookly - Online Scheduling and Appointment Booking System plugin in versions up to and including 28.4. The classic booking form's Details step endpoint bookly_render_details is registered for wp_ajax_nopriv, its csrfTokenValid() check is overridden to always return true, and InfoText::getCodes() loads a persisted Customer entity keyed solely by the attacker-supplied phone or email without ever calling the plugin's customerIdentityConfirmed() predicate, so {client_name}, {client_email}, {client_phone} and {client_note} placeholders are substituted into the returned HTML. Exploitation requires a non-default site configuration (the administrator must have inserted at least one of those placeholders into the Details step's Appearance information text) and a valid victim identifier, which limits this to targeted per-victim disclosure rather than bulk enumeration; no public exploit was identified at time of analysis. The flaw is fixed in Bookly 28.5.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin slug advanced-custom-fields-table-field, vendor jonua) affects all versions up to and including 1.4.1-RC2, allowing an authenticated attacker with subscriber-level access or above to inject arbitrary scripts into table field values that execute when a victim views a page rendering that field. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting the low privilege bar and scope change typical of stored XSS inside the WordPress rendering context, though exploitation stops short of RCE and depends on a victim viewing the poisoned content. No public exploit identified at time of analysis, and no evidence of active exploitation; vendor-released patch: 1.4.1.
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers with subscriber-level access to overwrite the WordPress user binding of any Bookly staff record, including those owned by administrators, by manipulating the 'id' and 'wp_user_id' parameters in the staff-edit AJAX endpoint. Exploitation requires the attacker to have a subscriber account and to be linked to at least one Bookly staff record, a condition present by default on fresh installs where the bookly_gen_allow_staff_edit_profile option is enabled. No public exploit code has been identified and CISA KEV does not list this vulnerability; the assessed CVSS is 6.8 with high attack complexity (AC:H) due to the prerequisite of a staff-linked subscriber account.
Authenticated privilege escalation in the Academy LMS WordPress plugin through version 4.0.3 lets a user with the academy_guardian role or higher assign the academy_student role to any existing WordPress account, including their own, via the guardian add_child REST API. The flaw stems from add_role('academy_student') executing before Store::link() validates the guardian-ward relationship and not rolling back on WP_Error, so even self-links rejected by Store::link() leave the role grant in place. This yields Contributor-equivalent edit_posts unconditionally and Author-equivalent upload_files only when the student file-upload setting is enabled; CVSS is 5.4 and no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Advanced Classifieds & Directory Pro WordPress plugin (versions up to and including 3.4.4) allows an authenticated attacker holding a 'custom-level' account or higher to inject arbitrary JavaScript through the 'phone' parameter of a listing, which then executes for any user viewing the poisoned page. Exploitation is gated behind two non-default operator choices: the 'Force Bootstrap' miscellaneous setting must be enabled and the 'ACADP Listing Address' widget must be placed in a sidebar rendered on single listing pages, so default-configured sites are not exposed. No public exploit code or confirmed in-the-wild exploitation (CISA KEV) was identified at time of analysis, and the reported CVSS 6.4 score is softened by our reassessment to AC:H given the stacked prerequisite chain.
Authorization bypass in the Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (all versions up to and including 4.0.3) allows any user who holds an instructor role for at least one course to permanently delete lesson comments and their replies belonging to courses they do not instruct, including comments authored by administrators. Exploitation requires an authenticated account with instructor-level access (CVSS PR:L), and the attacker supplies their own valid course_id to pass the plugin's flawed instructor check while targeting comment IDs from other courses; the abuse results in irreversible content destruction (integrity impact High, confidentiality and availability unaffected per the assessed vector). No public exploit code has been identified at time of analysis, the issue is not listed as confirmed actively exploited (CISA KEV), and the assessed severity is moderate (CVSS 6.5) rather than an emergency, primarily because the instructor-account prerequisite confines the threat to semi-trusted internal users.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
SQL injection in the wp-post-author WordPress plugin before version 4.1.0 lets an authenticated attacker with high privileges inject arbitrary SQL through a plugin endpoint, allowing disclosure of data stored in the underlying WordPress database. The flaw is rated CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so exploitation requires an existing high-privilege account on the target site, no user interaction, and the impact is limited to confidentiality - integrity and availability are unaffected. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity of the attack path means this should be treated as a realistic post-compromise or insider data-exfiltration vector on multi-author WordPress installations.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Authentication bypass in the Automattic Jetpack WordPress plugin, affecting all versions through 16.2, allows unauthenticated remote attackers to abuse the plugin's password-recovery flow and reach an authenticated state without valid credentials. No user interaction is required (PR:N/UI:N), but the assessed vector carries high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control - likely a timing/race window or a specific state in the recovery process - which limits reliable exploitation. Impact is partial (C:L/I:L, A:N) rather than full account or site takeover, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Jetpack WordPress plugin versions through 16.2 contain an authentication bypass in the password-recovery workflow, allowing remote unauthenticated attackers to achieve limited account compromise. The vulnerability requires specific conditions to be met (high attack complexity per CVSS), and no public exploit identified at time of analysis; with a CVSS score of 4.8, it represents a moderate-severity issue that should be addressed but is not a top-priority emergency.
Sensitive information disclosure in QA Analytics WordPress plugin versions through 5.3.0.0 allows unauthenticated remote attackers to retrieve embedded sensitive data sent to clients. This medium-severity flaw (CVSS 4.0 6.9, CWE-201) affects sites with the plugin's heatmap/analytics data-collection feature active, and no public exploit has been identified at time of analysis.
Authenticated WordPress users holding only low-level permissions can create and publish Envira galleries they are not entitled to, and can bind image attachments they do not own into those galleries, when the site runs Envira Gallery Lite before 1.16.2. The root cause is a missing authorization check (CWE-862) in the plugin's gallery conversion REST endpoint, which validates edit rights on a source post instead of the capability required to create or publish galleries, and then writes a hard-coded publish status; caller-supplied image IDs are accepted without ownership verification. Impact is confined to integrity - unauthorized gallery creation and improper reuse of existing media - with no confidentiality or availability loss; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
All Bootstrap Blocks WordPress plugin through version 1.3.31 exposes embedded sensitive data to authenticated attackers with low-level WordPress privileges, allowing retrieval of limited confidential information from affected sites. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation requires an authenticated PR:L account and causes only confidentiality impact; no user interaction is needed and unauthenticated visitors cannot exploit it. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Missing authorization in the Asgaros Forum WordPress plugin (versions through 3.4.0) lets a logged-in low-privilege account reach a forum function that should be gated by a capability check, resulting in limited information disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms that an attacker must already hold an account on the target site - typically any registered forum member - because the flaw is a missing authorization check rather than an unauthenticated entry point, and the impact is confined to confidentiality with no integrity or availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a moderate, low-priority issue; sites that do not allow untrusted user registration sharply reduce their exposure.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.
Authenticated users with only low-level privileges on a WordPress site running the WP Event Manager plugin (all versions through 3.4.1) can reach plugin actions and data that should require higher capabilities, because the plugin fails to enforce authorization checks. The flaw is a Missing Authorization issue (CWE-862) rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N): it is not remotely unauthenticated, and impact is limited to partial confidentiality and integrity loss with no availability impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified from the available data; risk is materially higher on sites that allow open user registration or host multiple semi-trusted accounts, and lower where all registered users are fully trusted.
Missing authorization checks in the WordPress plugin Scripts n Styles (unFocus Projects) through version 3.5.8 let unauthenticated, remote attackers reach functionality or data that should be restricted to privileged users. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (base 5.3), no credentials, no user interaction and no non-default configuration are required - any site with the plugin installed and active at or below 3.5.8 is exposed, with impact bounded to low confidentiality loss and no integrity or availability effect. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and no EPSS score was supplied; risk is therefore driven primarily by the plugin's presence and version rather than confirmed threat activity. The advisory, reported by Patchstack, does not disclose the specific vulnerable sub-functionality.
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.
Forging payment webhook signatures in the Super Payments WordPress plugin (before 1.43.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without payment, because the plugin ships with an empty signature-validation signing key by default. The medium-severity (CVSS 5.3) integrity flaw has business impact that exceeds its raw score; publicly available exploit code exists, though no confirmed active exploitation has been observed (not listed in CISA KEV). Affected sites are those using the vulnerable plugin with WooCommerce and exposed webhook endpoints, and the default configuration itself is the enabling condition.
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.
Missing CSRF protection in the GDPR Data Request Form WordPress plugin through 1.7.1 allows a remote attacker to change one plugin setting if they can trick a logged-in administrator into clicking a crafted link. Publicly available exploit code exists, but exploitation is targeted and requires an authenticated admin session plus user interaction, with impact limited to integrity of that single setting and no confidentiality or availability effect. This matches the assessed low-to-moderate real-world risk despite the CVSS 4.3 score.
SQL injection in Testimonials by BestWebSoft WordPress plugin through 1.0.8 lets unauthenticated remote attackers append SQL to a database query and read data from the underlying WordPress database. Publicly available exploit code exists (reported by WPScan), with no CISA KEV confirmation of active exploitation. The independent assessment rates this as a moderate-priority, network-reachable, low-complexity issue with no authentication or user interaction and confidentiality-only impact; the supplied CVSS vector's AC:H and S:C are not supported by the description and should be treated cautiously.
Missing authorization in the ThemeGrill User Registration WordPress plugin, affecting all releases through 5.2.7, lets remote attackers (no authentication or user interaction required per the reported CVSS vector) invoke functionality that should be gated behind capability or role checks, with limited confidentiality, integrity, and availability impact. The reported CVSS 5.6 with AC:H reflects that successful exploitation likely depends on a specific plugin feature, role/permission configuration, or application state rather than working against every default install. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the available data does not name the precise vulnerable endpoint, so the modified/affected action must be confirmed from the Patchstack advisory.
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting in the Classified Listing WordPress plugin through version 6.1.2 allows an authenticated attacker with listing-creation privileges to inject persistent JavaScript that executes when an administrator or other user views the affected listing. Exploitation requires a low-privileged account (PR:L) and victim interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-risk, low-urgency issue; practical impact depends on whether untrusted users can submit listings and whether those listings are rendered to privileged viewers.
Missing authorization in the codemstory SimplePay for WooCommerce payment plugin (slug pgall-for-woocommerce, marketed in Korean as 워드프레스 결제 심플페이) up to and including version 5.5.17 lets unauthenticated remote attackers change the plugin's payment gateway configuration - the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms no login and no user interaction are required. Rated CVSS 3.1 base 6.5 (Medium) with impact sub-scores C:N/I:L/A:L, so the realistic harm is tampering with settings and disruption of the checkout/payment flow rather than data disclosure or code execution, and the plugin's narrow, Korea-focused deployment further limits exposure; no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.
Privilege escalation in the Ultimate Member WordPress plugin (all versions through 2.13.1) arises from an incorrect privilege assignment that lets a user reach permissions beyond those they should legitimately hold. The assessed vector - CVSS 5.6 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) - combines high attack complexity with low-privileged access, meaning exploitation depends on specific conditions rather than a single trivial request, and the resulting confidentiality, integrity, and availability impact is limited rather than site-takeover grade. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), so this should be treated as a moderate-priority patch item for any WordPress site running the plugin at or below 2.13.1.
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
Unauthenticated visitors can execute shortcodes registered on a WordPress site running Kirki before 6.3.2 by submitting a comment, and can read private custom fields of the page being viewed, because the plugin renders shortcodes held in comment text and displays comments regardless of their moderation status. The vulnerability carries a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with the high attack complexity reflecting that real-world impact depends on which shortcodes a site has registered and whether comments are enabled; publicly available exploit code exists, though there is no CISA KEV listing confirming active exploitation at time of analysis. A vendor patch is available in Kirki 6.3.2.
Missing authorization in WP Rocket for WordPress before 3.23.5 exposes plugin actions that lack proper capability checks, allowing attackers to reach functionality they should not be permitted to use. The reported CVSS vector lists network access with no privileges or user interaction, but the CWE-862 classification and independent assessment indicate the realistic barrier is possession of a valid low-privilege WordPress account, such as Subscriber, which is the key limiter on exploitability. No public exploit code was identified at time of analysis, the issue is moderate risk rather than emergency priority, and it is resolved by updating to 3.23.5 or later.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
SQL injection in the Code Snippets WordPress plugin before version 3.10.0 allows a site Administrator - on a WordPress Multisite network that means a subsite Administrator, not a network Super Admin - to run UNION-based queries against shared network tables via the plugin's snippet-migration import endpoints, exposing network-wide data such as other users' password hashes. The flaw requires an authenticated account with site-administration capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8), so there is no anonymous exploitation path; publicly available exploit code exists and the WPScan advisory documents the vector, but EPSS is low (0.16%, 4th percentile) and CISA SSVC records no observed exploitation. Real-world impact is concentrated in multi-tenant Multisite networks where subsite admins are untrusted, since on a single-site install the acting administrator already has legitimate database access.
Subsite administrators on WordPress multisite networks running the Code Snippets plugin before 3.10.0 can activate, deactivate, and reprioritise network-scoped snippets that execute across every site in the network, because one of the plugin's snippet-management actions omits a capability check and derives the snippet's network scope from the request instead of the stored record. The issue is an authenticated authorization flaw (CWE-862, CVSS 3.1 base 3.3, vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) that only affects multisite deployments with at least one network-scoped snippet already present and an attacker who already holds administrator rights on a subsite. Publicly available exploit code exists for this issue, but EPSS is only 0.13% (2nd percentile) and there is no confirmed actively exploited (CISA KEV) status; practical impact is limited to toggling or reordering existing snippets rather than injecting arbitrary new code.
Unauthenticated payment-status forgery in the UnitechPay WordPress plugin (through version 1.0.6.3) allows remote attackers to mark orders as paid without any payment being made and to force other orders into a failed state. The plugin's payment-notification handler consumes incoming notifications without verifying their authenticity, so a forged callback reaches the affected site with no credentials and no user interaction (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, integrity-only impact of C:N/I:L/A:N, CWE-862). Publicly available exploit code exists, but the issue is not listed as confirmed actively exploited (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so the signals are consistent and point to a moderate, not critical, priority for sites that actually run and rely on this plugin for checkout.
Unauthenticated attackers can overwrite arbitrary options in the Social Web Suite WordPress plugin through version 4.1.12 by abusing a settings-write endpoint that performs no authorization check, with the most damaging target being the shared secret that guards the plugin's own privileged endpoints. Because the CVSS vector is PR:N/UI:N, no credentials, privileges, or user interaction are required; the only precondition is that the plugin be installed and active on an internet-reachable WordPress site, and default configurations are affected. Impact is confined to integrity (C:N/I:L/A:N, base 5.3) rather than direct code execution or data disclosure, but public exploit code exists in the form of the WPScan proof-of-concept, so weaponization by opportunistic scanners is plausible. EPSS is low at 0.14% (3rd percentile), and there is no indication of confirmed active exploitation in CISA KEV; treat this as a moderate-priority stepping-stone issue rather than a catastrophic flaw.
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.
Stored cross-site scripting in the Zotpress WordPress plugin through 7.4.4 allows an authenticated low-privilege user to inject persistent JavaScript that executes when another user views the affected page. The assessed CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and no public exploit code or confirmed active exploitation was identified in the provided intelligence. Because exploitation requires a low-privilege account plus victim interaction, risk is highest on multi-author WordPress sites, while single-admin or closed-registration blogs have a reduced attack surface.
Missing authorization in the Creator LMS WordPress plugin (versions through 1.2.21) lets unauthenticated remote attackers invoke plugin functionality that should require elevated privileges, producing a limited integrity impact - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) confirms no authentication, no user interaction, and no confidentiality or availability loss. Any WordPress site running the affected plugin version that is reachable over the network is exposed, with default configurations affected. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was included in the supplied intelligence, so the practical risk is best characterized as moderate and dependent on whether the plugin is installed and exposed.
Stored cross-site scripting in the WordPress plugin WP Plugin Info Card (all versions through 6.3.5) lets an authenticated user with low-level posting privileges place a malicious script into content that the plugin later renders as an info card, so the payload executes in the browser of any user who views the affected page. Successful exploitation requires two separate conditions: the attacker must already hold a WordPress account able to create or edit the relevant content (PR:L), and a victim - typically an administrator or another site user - must subsequently view the rendered card (UI:R); the flaw is not reachable by fully unauthenticated attackers and does not fire automatically. Patchstack rates it CVSS 6.5, and there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the practical exposure is limited to sites running the plugin with multiple content-authoring accounts.
Unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the Visual Composer Website Builder WordPress plugin (versions through 45.16.3) to access information they should not be able to reach. The vulnerability is rated CVSS 5.3 with network attack vector, no privileges required, and no user interaction, but only low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the StellarWP Event Tickets WordPress plugin (versions through 5.30.0.1) allows attackers to manipulate a user-controlled object key - such as a ticket, order, or attendee identifier - so that records they do not own can be located and altered, because the affected endpoint performs no server-side ownership check. The flaw is rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, confining impact to the integrity of specific records with no confidentiality or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the effective privilege requirement should be validated because comparable WordPress-plugin IDORs frequently require at least a low-privileged authenticated session despite a PR:N vector.
Missing authorization in Event Tickets 5.30.0.1 and earlier allows an authenticated low-privileged WordPress user, such as a subscriber or customer, to perform a restricted event-ticket action they should not be authorized to perform. The affected product is the Liquid Web/StellarWP Event Tickets WordPress plugin, and the issue carries a moderate CVSS score of 4.3 with only low integrity impact and no confidentiality or availability impact. Exploitation requires a valid login but no victim interaction, and no public exploit identified at time of analysis.
Stored cross-site scripting in Gutenberg Blocks by Kadence Blocks (also distributed as Kadence Blocks) affects WordPress installations running version 3.7.12 or earlier, allowing an authenticated user with contributor- or author-level posting rights to embed malicious script content inside Kadence blocks that executes when a higher-privileged user - typically an administrator or editor - later views or previews the affected post. Because the injected script runs in the privileged user's session, the attacker can hijack administrative actions, inject further content, or persist access, although exploitation depends on both obtaining a content-creation account and a privileged victim rendering the poisoned content. No public exploit code has been identified at time of analysis and there is no indication of active exploitation (CISA KEV); the issue is assessed as moderate priority rather than top-tier.
Low-privilege authenticated users can bypass authorization on Event Tickets (a WordPress plugin by Liquid Web / StellarWP) versions up to and including 5.30.0.1, reaching functionality that lacks a proper capability check and thereby reading or modifying event and ticket data they should not control. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CWE-862) - exploitation requires only any valid logged-in account, such as a self-registered subscriber or ticket purchaser, so sites that permit open registration carry the most exposure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the Patchstack advisory makes the weakness straightforward to probe for on unpatched installations.
Stored cross-site scripting in the Robo Gallery WordPress plugin (versions through 5.1.6) lets an authenticated low-privilege user - such as a contributor or author with posting rights - persist malicious JavaScript into gallery content, which then executes in the browser of any user who later views the affected page, typically an administrator. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) because the payload can alter the rendering scope and requires victim interaction to fire, the practical exposure is limited to sites that grant untrusted accounts the ability to create or edit Robo Gallery content. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the issue was reported via Patchstack.
Medium-severity (CVSS 6.5) missing authorization flaw (CWE-862) in BdThemes Ultimate Post Kit WordPress plugin versions up to and including 4.5.5 allows an authenticated low-privilege user (such as a subscriber or contributor) to access a plugin function or endpoint that lacks proper authorization checks, resulting in high confidentiality impact (information disclosure) with no integrity or availability impact. Exploitation requires the target site to allow low-privileged accounts; sites that disable open registration or restrict such roles are not affected. No public exploit identified at time of analysis.
Stored cross-site scripting in the MasterStudy LMS WordPress plugin (versions through 3.7.52) allows an authenticated attacker with a low-privilege role, such as a student or instructor, to inject persistent JavaScript that executes when a privileged user views the affected page or dashboard view. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); exploitation requires victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in the WP Store Locator WordPress plugin through version 3.0.3 allows an authenticated low-privilege user to inject script that is persisted and later rendered without neutralization, executing in the browser of a privileged victim who views the affected page. The assessed CVSS 3.1 base score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a network-reachable flaw that requires a valid low-privilege account (PR:L) and victim interaction (UI:R) rather than unauthenticated access. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE, so real-world exploitation is constrained by the need for an authenticated foothold and for an administrator or editor to actually view the attacker-controlled content.
Missing authorization checks in the VillaTheme Core WordPress plugin, affecting versions up to and including 1.0.5, allow an authenticated low-privilege user to reach plugin functionality that should require higher capabilities, resulting in limited information disclosure. The flaw carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and per the assessed vector is not exploitable by unauthenticated users - an account on the WordPress site is a prerequisite (PR:L). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is limited to low confidentiality exposure with no integrity or availability effect, making this a moderate, low-priority issue.
Stored cross-site scripting in ShortPixel Image Optimizer versions through 6.5.6 allows an authenticated low-privileged WordPress user to inject JavaScript that executes when a higher-privileged victim views the affected plugin-generated page. The vulnerability is a CWE-79 improper-neutralization issue in a WordPress plugin, requires the plugin to be installed and active, and is not remotely exploitable by an unauthenticated attacker against a default install. No public exploit identified at time of analysis, and no EPSS score was supplied; the assessed severity is moderate with scope change and limited confidentiality and integrity impact.
Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
Authorization bypass in the WordPress plugin HollerBox (Groundhogg) through version 2.3.14 allows unauthenticated remote attackers to manipulate plugin-managed objects by supplying a user-controlled key that the plugin fails to validate against ownership or access level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms no authentication or user interaction is required and impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV).
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions before 3.7.1 to create a WordPress account and obtain a logged-in session, with the new user assigned the site's default role. Publicly available exploit code exists, and the independent assessment rates this as a moderate-priority issue (CVSS 5.3) rather than a critical emergency, because the impact is largely determined by the default role-typically a low-privilege Subscriber. Sites that rely on disabled registration for protection are directly exposed, while those with registration already enabled see little added risk.
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
Unauthenticated information disclosure in the Track Orders for WooCommerce WordPress plugin before 1.2.7 lets anyone who already knows a customer's email address retrieve that customer's name, email, phone number, postal address and order history from the plugin's order-tracking lookup. The lookup returns billing details without ever verifying that the requester owns the referenced order, and because the CVSS vector confirms PR:N and UI:N, no account or interaction is needed - the only gating factor is prior possession of a valid customer email. No public exploit identified at time of analysis and no confirmed active exploitation (the flaw is not listed in CISA KEV), but CISA's SSVC assessment marks it automatable, and the vendor has released a fix in version 1.2.7.
Cross-site user data disclosure in the SMS Alert WordPress plugin before 4.0.1 allows an administrator of one subsite on a WordPress multisite network to retrieve stored billing phone numbers belonging to users of other subsites on that network. The flaw only affects multisite installations, and exploitation further requires the SMS Alert SMS gateway credentials to be configured and stored on the acting administrator's own site; the attacker must already hold administrator privileges on at least one subsite (CVSS vector PR:H, authenticated), so this is realistically a cross-tenant disclosure by a trusted or compromised admin rather than unauthenticated remote exploitation. Scoring is low (vendor score 2.7; our assessment is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV); patched plugin version 4.0.1 is available from the vendor.
Insufficient authorization in the Wallet System for WooCommerce WordPress plugin before 2.8.0 lets any authenticated user - a subscriber-level account is sufficient - file a withdrawal request against another user's wallet while freely choosing the amount and the payout destination. Because the plugin never checks that the wallet named in the submission belongs to the submitter, the attacker can also repeatedly lodge requests that indefinitely block the victim from making legitimate withdrawals of their own, producing an immediate denial-of-service effect even when no funds move. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; wallets with balances are the meaningful targets, and actual fund transfer typically still depends on an administrator approving the payout.
Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). Stores with open customer registration and the wallet-transfer feature enabled are directly exposed; no public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Information disclosure in the Wallet System for WooCommerce plugin before 2.8.0 allows any authenticated user on a WordPress site - the description states a subscriber-level account is sufficient - to generate and download a report containing every customer's wallet transaction history, including names, email addresses, user roles, transaction amounts, payment methods and dates. The report endpoint performs no capability check and instead trusts a token that the plugin renders on a front-end page, so any logged-in user can retrieve the token and then invoke the endpoint; no user interaction is required. The published base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while our assessment rates the confidentiality impact as High (C:H) because the exposure covers complete customer PII and the store's full financial transaction ledger. No public exploit code identified at time of analysis; patch available in 2.8.0.
Path traversal in the BackWPup WordPress plugin before 5.7.7 lets a high-privileged, authenticated user (PR:H, typically a WordPress administrator with backup/restore permissions) write files outside the intended restore directory by supplying a crafted backup archive during a restore that runs through the plugin's fallback archive library, which can escalate to remote code execution. The CVSS 3.1 base score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high privileges and the non-default fallback-library code path required rather than a broad unauthenticated attack surface. A vendor patch is available in BackWPup 5.7.7, and no public exploit code was identified at time of analysis; exploitation is not confirmed as active (no CISA KEV listing).
Unauthenticated attackers can force any pre-existing backup job in the BackWPup WordPress plugin (versions 3.3 through 5.7.6) to execute immediately by sending a request straight to its cron-triggered backup execution handler, which does not confirm the request originated from WordPress's internal scheduled-event dispatch. The attacker cannot create, edit, or delete jobs and gains no access to backup contents, so the practical impact is confined to unscheduled job execution and the resulting resource consumption rather than data exposure. No public exploit code or confirmed active exploitation was identified at the time of analysis, and EPSS data was not supplied; the vendor fixed the issue in BackWPup 5.7.7.
Information disclosure in the BackWPup WordPress plugin before 5.7.7 lets unauthenticated remote attackers download a complete backup archive - database dump, site files, credentials and secret keys - left behind in the plugin's working directory by an interrupted restore. Exploitation is conditional: it requires the site to run a webserver that does not enforce .htaccess restrictions (explicitly NGINX) plus an interrupted restore that left the archive in place, which is why the assessed vector carries AC:H despite PR:N, AV:N. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so this rates as a genuine but conditional information-disclosure flaw rather than an emergency, though the high confidentiality impact of leaked database and secret-key material warrants prompt patching.
Deletion of stored form entries in the WordPress plugin Database Addon for WPForms (also distributed as 'wpforms entries') is possible against any site running a version before 1.1.1, because the entry-removal handler fails to validate a CSRF nonce when that field is omitted and performs no capability check of its own. An attacker can host a crafted page that, when loaded by a logged-in WordPress administrator, silently submits the deletion request on the victim's behalf; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network reachability and low complexity but gates success on administrator interaction. Impact is integrity-only (C:N/I:L/A:N, CVSS 4.3 Medium) and limited to removal of stored form submissions, with no code execution, data disclosure, or site availability loss; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Unauthenticated visitors can retrieve any customer's name, contact details, and order confirmation code from WordPress sites running the Appointment Booking Plugin before version 5.7.3 due to an insecure direct object reference (IDOR, CWE-639) in the order confirmation summary flow. The plugin fails to verify that the caller owns the order referenced by a sequential order-item identifier, allowing enumeration of all booking confirmations. No public exploit has been identified at time of analysis, but the predictable identifiers make the flaw trivially exploitable whenever booking orders exist, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms it is network-reachable without authentication or user interaction.
Irreversible deletion of orders, customers, and transactions stored by the Appointment Booking Plugin for WordPress is possible for authenticated backend staff users in all versions before 5.6.5, because the plugin's deletion routine never confirms that the acting staff account is authorized for the specific record it is asked to remove. An attacker holding a record-scoped staff role (for example, a staff member whose scope is limited to their own appointments) can supply an arbitrary record identifier and destroy data belonging to other staff or entirely outside their assigned scope, and the deletion cannot be undone. The vulnerability is network-reachable and requires no user interaction, but the principal barrier is the prerequisite of an existing backend staff login, which keeps the practical risk low and consistent with the vendor's 2.7 score; no public exploit code has been identified at time of analysis.
Authenticated agents can bypass per-record authorization in the Appointment Booking Plugin (LatePoint) before 5.6.9, enabling them to read and modify other agents' profile data and read other agents' bookings and customer details when the optional AI Abilities API feature is enabled. The flaw is a CWE-639 authorization bypass via user-controlled keys. No public exploit code or active exploitation has been identified, and the assessed CVSS is low (3.3) due to the requirement for an authenticated agent account and the optional feature.
Booking Calendar, a WordPress plugin, fails to restrict which WordPress options a lower-privileged user can retrieve through one of its settings handlers, so an authenticated account holding the Editor role or higher can read the values of arbitrary entries in the site's options table - including core site configuration - in plugin versions from 10.15 up to but not including 11.8.3. The issue is rated CVSS 3.1 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable but high-privilege-only path with limited confidentiality impact and no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is concentrated on sites that hand Editor-level access to untrusted or compromised accounts. A vendor-released patch exists: 11.8.3.
Authenticated information disclosure in the Easy Digital Downloads WordPress plugin before 3.7.1 allows any subscriber-level account to read other customers' recent order contents and harvest signed download links that grant free access to paid digital files. The flaw rates CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200) because exploitation requires a valid low-privilege login, making it most dangerous on sites that allow open or self-service registration. No public exploit identified at time of analysis; vendor-released patch: 3.7.1.
Predictable per-booking access hashes in the Booking Calendar WordPress plugin before 11.8 let unauthenticated attackers read a booking's personal data or modify the booking in place, provided they can determine or closely estimate when that booking was created. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting that no login or victim interaction is needed but that the attack is targeted and per-booking rather than mass-exploitable, since the low-entropy, time-seeded value behind each hash must be narrowed down first. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor remediation is available in version 11.8.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (versions before 3.6.14) lets an authenticated attacker with contributor-level access or above inject arbitrary JavaScript that runs in the browser session of anyone viewing the affected post. The flaw arises because several gallery configuration values can be overridden through the plugin's gallery shortcode and are printed unsanitised into an inline script block; because no gallery ownership is required, any gallery already present on the site can be referenced, and an administrator previewing a pending contributor submission is the most likely victim. Exploitation requires the victim to load the crafted post (UI:R), there is no public exploit identified at time of analysis, and a vendor-released patch in version 3.6.14 is available.
Authenticated WordPress users holding contributor-level access or higher can clone, modify, reorder, and write plugin metadata onto galleries and images owned by other users on any site running the Image Photo Gallery Final Tiles Grid plugin before 3.6.14. The root cause is incomplete object-ownership verification in the plugin's gallery and image management actions, where authorization is checked against a different object than the one being acted on or omitted entirely, producing a low-integrity authorization bypass with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and real-world risk is low because an attacker must already possess a contributor account on the target site; a vendor-released patch is available in version 3.6.14.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Stored cross-site scripting in the Aurora Heatmap WordPress plugin affects all versions up to and including 1.7.2 and lets unauthenticated attackers inject arbitrary JavaScript through the plugin's 'url' parameter, with the payload firing in an administrator's browser whenever that admin clicks the injected heatmap link. The flaw is rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to plant the payload but a successful attack depends on an administrator later interacting with the malicious link; impact is limited to information disclosure and limited integrity within the admin's browser session, with no availability impact. There is no public exploit identified at time of analysis, and the plugin should be treated as untrusted until a fixed build is confirmed. An upstream Trac changeset (3712276) indicates code changes addressing the issue, but no patched release version has been independently confirmed.
Reflected cross-site scripting in the Fluent Forms WordPress plugin (all versions up to and including 6.2.14) allows unauthenticated attackers to inject arbitrary script into pages via a crafted query parameter that is substituted into a {get.NAME} SmartCode. Exploitation is not possible on a default install: a site administrator must first have placed a {get.*} SmartCode inside a URL-accepting attribute (such as an iframe src or anchor href) within a Custom HTML field on a published form, and a victim with a session on the site must then be tricked into clicking an attacker-supplied link. No public exploit identified at time of analysis, and the issue is a genuine-but-moderate-priority problem rather than a drop-everything emergency given the non-default configuration prerequisite and the AC:H/UI:R scoring.
Stored cross-site scripting in the GeoDirectory WordPress plugin (all versions up to and including 2.8.188) allows authenticated users with subscriber-level access or above to plant arbitrary JavaScript in listing data via the 'Contact Email' custom field, which then executes in the browser of anyone viewing the affected public single-listing page. Exploitation is not a default-configuration issue: the site administrator must first have added and configured the Contact Email custom field (htmlvar_name 'email') to render on public single-listing output and must subsequently approve the attacker's submitted listing before the payload becomes live, which is why the independent assessment rates the vector AC:H and describes this as conditionally exploitable rather than broadly reachable. There is no public exploit code or confirmed active exploitation at time of analysis, and no EPSS or KEV signal accompanies this record; residual risk is concentrated in sites that permit low-privilege registration, accept untrusted listing submissions, and expose the Contact Email field publicly.
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.
Unauthenticated attackers who already know a registered customer's primary phone number or email can read that customer's stored name, email, phone and internal notes from WordPress sites running the Bookly - Online Scheduling and Appointment Booking System plugin in versions up to and including 28.4. The classic booking form's Details step endpoint bookly_render_details is registered for wp_ajax_nopriv, its csrfTokenValid() check is overridden to always return true, and InfoText::getCodes() loads a persisted Customer entity keyed solely by the attacker-supplied phone or email without ever calling the plugin's customerIdentityConfirmed() predicate, so {client_name}, {client_email}, {client_phone} and {client_note} placeholders are substituted into the returned HTML. Exploitation requires a non-default site configuration (the administrator must have inserted at least one of those placeholders into the Details step's Appearance information text) and a valid victim identifier, which limits this to targeted per-victim disclosure rather than bulk enumeration; no public exploit was identified at time of analysis. The flaw is fixed in Bookly 28.5.
Stored cross-site scripting in the Table Field Add-on for ACF and SCF (WordPress plugin slug advanced-custom-fields-table-field, vendor jonua) affects all versions up to and including 1.4.1-RC2, allowing an authenticated attacker with subscriber-level access or above to inject arbitrary scripts into table field values that execute when a victim views a page rendering that field. The issue carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting the low privilege bar and scope change typical of stored XSS inside the WordPress rendering context, though exploitation stops short of RCE and depends on a victim viewing the poisoned content. No public exploit identified at time of analysis, and no evidence of active exploitation; vendor-released patch: 1.4.1.
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers with subscriber-level access to overwrite the WordPress user binding of any Bookly staff record, including those owned by administrators, by manipulating the 'id' and 'wp_user_id' parameters in the staff-edit AJAX endpoint. Exploitation requires the attacker to have a subscriber account and to be linked to at least one Bookly staff record, a condition present by default on fresh installs where the bookly_gen_allow_staff_edit_profile option is enabled. No public exploit code has been identified and CISA KEV does not list this vulnerability; the assessed CVSS is 6.8 with high attack complexity (AC:H) due to the prerequisite of a staff-linked subscriber account.
Authenticated privilege escalation in the Academy LMS WordPress plugin through version 4.0.3 lets a user with the academy_guardian role or higher assign the academy_student role to any existing WordPress account, including their own, via the guardian add_child REST API. The flaw stems from add_role('academy_student') executing before Store::link() validates the guardian-ward relationship and not rolling back on WP_Error, so even self-links rejected by Store::link() leave the role grant in place. This yields Contributor-equivalent edit_posts unconditionally and Author-equivalent upload_files only when the student file-upload setting is enabled; CVSS is 5.4 and no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Advanced Classifieds & Directory Pro WordPress plugin (versions up to and including 3.4.4) allows an authenticated attacker holding a 'custom-level' account or higher to inject arbitrary JavaScript through the 'phone' parameter of a listing, which then executes for any user viewing the poisoned page. Exploitation is gated behind two non-default operator choices: the 'Force Bootstrap' miscellaneous setting must be enabled and the 'ACADP Listing Address' widget must be placed in a sidebar rendered on single listing pages, so default-configured sites are not exposed. No public exploit code or confirmed in-the-wild exploitation (CISA KEV) was identified at time of analysis, and the reported CVSS 6.4 score is softened by our reassessment to AC:H given the stacked prerequisite chain.
Authorization bypass in the Academy LMS - AI Course Builder, Quizzes, Certificates & eLearning WordPress plugin (all versions up to and including 4.0.3) allows any user who holds an instructor role for at least one course to permanently delete lesson comments and their replies belonging to courses they do not instruct, including comments authored by administrators. Exploitation requires an authenticated account with instructor-level access (CVSS PR:L), and the attacker supplies their own valid course_id to pass the plugin's flawed instructor check while targeting comment IDs from other courses; the abuse results in irreversible content destruction (integrity impact High, confidentiality and availability unaffected per the assessed vector). No public exploit code has been identified at time of analysis, the issue is not listed as confirmed actively exploited (CISA KEV), and the assessed severity is moderate (CVSS 6.5) rather than an emergency, primarily because the instructor-account prerequisite confines the threat to semi-trusted internal users.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
SQL injection in the wp-post-author WordPress plugin before version 4.1.0 lets an authenticated attacker with high privileges inject arbitrary SQL through a plugin endpoint, allowing disclosure of data stored in the underlying WordPress database. The flaw is rated CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so exploitation requires an existing high-privilege account on the target site, no user interaction, and the impact is limited to confidentiality - integrity and availability are unaffected. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity of the attack path means this should be treated as a realistic post-compromise or insider data-exfiltration vector on multi-author WordPress installations.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Authentication bypass in the Automattic Jetpack WordPress plugin, affecting all versions through 16.2, allows unauthenticated remote attackers to abuse the plugin's password-recovery flow and reach an authenticated state without valid credentials. No user interaction is required (PR:N/UI:N), but the assessed vector carries high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control - likely a timing/race window or a specific state in the recovery process - which limits reliable exploitation. Impact is partial (C:L/I:L, A:N) rather than full account or site takeover, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Jetpack WordPress plugin versions through 16.2 contain an authentication bypass in the password-recovery workflow, allowing remote unauthenticated attackers to achieve limited account compromise. The vulnerability requires specific conditions to be met (high attack complexity per CVSS), and no public exploit identified at time of analysis; with a CVSS score of 4.8, it represents a moderate-severity issue that should be addressed but is not a top-priority emergency.
Sensitive information disclosure in QA Analytics WordPress plugin versions through 5.3.0.0 allows unauthenticated remote attackers to retrieve embedded sensitive data sent to clients. This medium-severity flaw (CVSS 4.0 6.9, CWE-201) affects sites with the plugin's heatmap/analytics data-collection feature active, and no public exploit has been identified at time of analysis.
Authenticated WordPress users holding only low-level permissions can create and publish Envira galleries they are not entitled to, and can bind image attachments they do not own into those galleries, when the site runs Envira Gallery Lite before 1.16.2. The root cause is a missing authorization check (CWE-862) in the plugin's gallery conversion REST endpoint, which validates edit rights on a source post instead of the capability required to create or publish galleries, and then writes a hard-coded publish status; caller-supplied image IDs are accepted without ownership verification. Impact is confined to integrity - unauthorized gallery creation and improper reuse of existing media - with no confidentiality or availability loss; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
All Bootstrap Blocks WordPress plugin through version 1.3.31 exposes embedded sensitive data to authenticated attackers with low-level WordPress privileges, allowing retrieval of limited confidential information from affected sites. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation requires an authenticated PR:L account and causes only confidentiality impact; no user interaction is needed and unauthenticated visitors cannot exploit it. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Missing authorization in the Asgaros Forum WordPress plugin (versions through 3.4.0) lets a logged-in low-privilege account reach a forum function that should be gated by a capability check, resulting in limited information disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms that an attacker must already hold an account on the target site - typically any registered forum member - because the flaw is a missing authorization check rather than an unauthenticated entry point, and the impact is confined to confidentiality with no integrity or availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a moderate, low-priority issue; sites that do not allow untrusted user registration sharply reduce their exposure.
Stored cross-site scripting in the bPlugins HTML5 Audio Player WordPress plugin (versions through 2.8.8) lets an authenticated low-privileged user - for example a contributor or author able to submit content the plugin stores - plant script payloads in plugin-handled data. The injected code persists and executes in the browser of any user who later views the affected page, such as an editor or administrator reviewing content, which can lead to session or credential theft and arbitrary actions in the victim's context; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and exploitation requires both an authenticated account on the target site and a victim who loads the tainted content, so sites that limit untrusted user registration are substantially less exposed.
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.
Authenticated users with only low-level privileges on a WordPress site running the WP Event Manager plugin (all versions through 3.4.1) can reach plugin actions and data that should require higher capabilities, because the plugin fails to enforce authorization checks. The flaw is a Missing Authorization issue (CWE-862) rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N): it is not remotely unauthenticated, and impact is limited to partial confidentiality and integrity loss with no availability impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified from the available data; risk is materially higher on sites that allow open user registration or host multiple semi-trusted accounts, and lower where all registered users are fully trusted.
Missing authorization checks in the WordPress plugin Scripts n Styles (unFocus Projects) through version 3.5.8 let unauthenticated, remote attackers reach functionality or data that should be restricted to privileged users. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (base 5.3), no credentials, no user interaction and no non-default configuration are required - any site with the plugin installed and active at or below 3.5.8 is exposed, with impact bounded to low confidentiality loss and no integrity or availability effect. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and no EPSS score was supplied; risk is therefore driven primarily by the plugin's presence and version rather than confirmed threat activity. The advisory, reported by Patchstack, does not disclose the specific vulnerable sub-functionality.
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.
Forging payment webhook signatures in the Super Payments WordPress plugin (before 1.43.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without payment, because the plugin ships with an empty signature-validation signing key by default. The medium-severity (CVSS 5.3) integrity flaw has business impact that exceeds its raw score; publicly available exploit code exists, though no confirmed active exploitation has been observed (not listed in CISA KEV). Affected sites are those using the vulnerable plugin with WooCommerce and exposed webhook endpoints, and the default configuration itself is the enabling condition.
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.
Missing CSRF protection in the GDPR Data Request Form WordPress plugin through 1.7.1 allows a remote attacker to change one plugin setting if they can trick a logged-in administrator into clicking a crafted link. Publicly available exploit code exists, but exploitation is targeted and requires an authenticated admin session plus user interaction, with impact limited to integrity of that single setting and no confidentiality or availability effect. This matches the assessed low-to-moderate real-world risk despite the CVSS 4.3 score.
SQL injection in Testimonials by BestWebSoft WordPress plugin through 1.0.8 lets unauthenticated remote attackers append SQL to a database query and read data from the underlying WordPress database. Publicly available exploit code exists (reported by WPScan), with no CISA KEV confirmation of active exploitation. The independent assessment rates this as a moderate-priority, network-reachable, low-complexity issue with no authentication or user interaction and confidentiality-only impact; the supplied CVSS vector's AC:H and S:C are not supported by the description and should be treated cautiously.
Missing authorization in the ThemeGrill User Registration WordPress plugin, affecting all releases through 5.2.7, lets remote attackers (no authentication or user interaction required per the reported CVSS vector) invoke functionality that should be gated behind capability or role checks, with limited confidentiality, integrity, and availability impact. The reported CVSS 5.6 with AC:H reflects that successful exploitation likely depends on a specific plugin feature, role/permission configuration, or application state rather than working against every default install. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the available data does not name the precise vulnerable endpoint, so the modified/affected action must be confirmed from the Patchstack advisory.
Missing authorization in the Magepeople 'Deposits and Partial Payments for WooCommerce' plugin (CWE-862) through version 4.0.1 lets an authenticated low-privilege user - such as a registered customer or subscriber on a store with self-registration enabled - invoke plugin functionality that should be restricted to higher-privileged roles, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation requires only a valid low-privilege session and needs no user interaction, making it practical on typical storefronts where customer accounts are freely creatable. No public exploit code and no confirmed active exploitation were identified for this CVE at time of analysis; the flaw is reported by Patchstack and tracked in the EU ENISA database as EUVD-2026-95623.
Stored cross-site scripting in the Crocoblock JetReviews WordPress plugin (versions through 3.1.2) lets an authenticated low-privilege user persist malicious script inside review content, which then executes in the browser of any visitor who later views the affected review page. Successful exploitation requires a valid account with permission to submit JetReviews content plus a victim who loads the poisoned page, so sites that do not allow untrusted users to post reviews are not exposed in practice. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); no public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV).
Stored cross-site scripting in the Classified Listing WordPress plugin through version 6.1.2 allows an authenticated attacker with listing-creation privileges to inject persistent JavaScript that executes when an administrator or other user views the affected listing. Exploitation requires a low-privileged account (PR:L) and victim interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-risk, low-urgency issue; practical impact depends on whether untrusted users can submit listings and whether those listings are rendered to privileged viewers.
Missing authorization in the codemstory SimplePay for WooCommerce payment plugin (slug pgall-for-woocommerce, marketed in Korean as 워드프레스 결제 심플페이) up to and including version 5.5.17 lets unauthenticated remote attackers change the plugin's payment gateway configuration - the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms no login and no user interaction are required. Rated CVSS 3.1 base 6.5 (Medium) with impact sub-scores C:N/I:L/A:L, so the realistic harm is tampering with settings and disruption of the checkout/payment flow rather than data disclosure or code execution, and the plugin's narrow, Korea-focused deployment further limits exposure; no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Missing authorization in the ProfilePress (wp-user-avatar) WordPress plugin through 4.17.3 allows an authenticated user with only low privileges to perform state-changing actions that should require higher-level capabilities, resulting in unauthorized modification of site data. The flaw is exploitable remotely over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base score 6.5), with impact confined to integrity; confidentiality and availability are unaffected per the assessed vector. No public exploit code and no active exploitation have been identified at time of analysis, and exposure is meaningfully reduced on sites that restrict or disable open user registration, since the attacker must first hold a valid low-privilege WordPress account.
ProfilePress versions up to and including 4.17.3 contain a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass incorrectly configured access control checks, potentially leading to unauthorized modification of site data. The flaw requires a specific high-complexity configuration condition (CVSS AC:H) to be exploitable, but when present, it can compromise integrity; confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score is 5.9, reflecting a moderate-severity, high-CVSS-but-tempered-real-risk issue.
Privilege escalation in the Ultimate Member WordPress plugin (all versions through 2.13.1) arises from an incorrect privilege assignment that lets a user reach permissions beyond those they should legitimately hold. The assessed vector - CVSS 5.6 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) - combines high attack complexity with low-privileged access, meaning exploitation depends on specific conditions rather than a single trivial request, and the resulting confidentiality, integrity, and availability impact is limited rather than site-takeover grade. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), so this should be treated as a moderate-priority patch item for any WordPress site running the plugin at or below 2.13.1.
Stored cross-site scripting in Crocoblock's JetBlocks For Elementor WordPress plugin (all versions through 1.5.2.1) allows an authenticated user with low-level privileges to plant persistent JavaScript inside plugin widget content, which then executes in the browser of any administrator or other viewer who loads the affected page - CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Because the payload is stored rather than reflected, a single successful injection can fire for every subsequent visitor until the content is cleaned, though it requires both a plugin-reachable account to inject (PR:L) and a victim to view the poisoned page (UI:R), so it does not self-propagate. No public exploit code and no confirmed active exploitation were identified in the available data; severity is driven mainly by the scope change (S:C) and the low-complexity, network-reachable attack path.
Server-side request forgery in the Kirki WordPress plugin before 6.3.2 allows authenticated users holding editor-level privileges or above to supply a URL that the WordPress server then fetches without validating the target host, letting them probe internal-only services and infer from the responses which of those hosts are live. The issue is rated CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so impact is confined to information disclosure with no write, code execution, or denial-of-service capability, and exploitation requires a trusted privileged account rather than anonymous access. Publicly available exploit code exists and WPScan is credited as the reporting source, but there is no CISA KEV confirmation of active exploitation; combined with the high privilege prerequisite, the signals converge on a modest, non-urgent priority appropriate for routine patching alongside other plugin updates.
Unauthenticated visitors can execute shortcodes registered on a WordPress site running Kirki before 6.3.2 by submitting a comment, and can read private custom fields of the page being viewed, because the plugin renders shortcodes held in comment text and displays comments regardless of their moderation status. The vulnerability carries a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with the high attack complexity reflecting that real-world impact depends on which shortcodes a site has registered and whether comments are enabled; publicly available exploit code exists, though there is no CISA KEV listing confirming active exploitation at time of analysis. A vendor patch is available in Kirki 6.3.2.
Missing authorization in WP Rocket for WordPress before 3.23.5 exposes plugin actions that lack proper capability checks, allowing attackers to reach functionality they should not be permitted to use. The reported CVSS vector lists network access with no privileges or user interaction, but the CWE-862 classification and independent assessment indicate the realistic barrier is possession of a valid low-privilege WordPress account, such as Subscriber, which is the key limiter on exploitability. No public exploit code was identified at time of analysis, the issue is moderate risk rather than emergency priority, and it is resolved by updating to 3.23.5 or later.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
SQL injection in the Code Snippets WordPress plugin before version 3.10.0 allows a site Administrator - on a WordPress Multisite network that means a subsite Administrator, not a network Super Admin - to run UNION-based queries against shared network tables via the plugin's snippet-migration import endpoints, exposing network-wide data such as other users' password hashes. The flaw requires an authenticated account with site-administration capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8), so there is no anonymous exploitation path; publicly available exploit code exists and the WPScan advisory documents the vector, but EPSS is low (0.16%, 4th percentile) and CISA SSVC records no observed exploitation. Real-world impact is concentrated in multi-tenant Multisite networks where subsite admins are untrusted, since on a single-site install the acting administrator already has legitimate database access.
Subsite administrators on WordPress multisite networks running the Code Snippets plugin before 3.10.0 can activate, deactivate, and reprioritise network-scoped snippets that execute across every site in the network, because one of the plugin's snippet-management actions omits a capability check and derives the snippet's network scope from the request instead of the stored record. The issue is an authenticated authorization flaw (CWE-862, CVSS 3.1 base 3.3, vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) that only affects multisite deployments with at least one network-scoped snippet already present and an attacker who already holds administrator rights on a subsite. Publicly available exploit code exists for this issue, but EPSS is only 0.13% (2nd percentile) and there is no confirmed actively exploited (CISA KEV) status; practical impact is limited to toggling or reordering existing snippets rather than injecting arbitrary new code.
Unauthenticated payment-status forgery in the UnitechPay WordPress plugin (through version 1.0.6.3) allows remote attackers to mark orders as paid without any payment being made and to force other orders into a failed state. The plugin's payment-notification handler consumes incoming notifications without verifying their authenticity, so a forged callback reaches the affected site with no credentials and no user interaction (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, integrity-only impact of C:N/I:L/A:N, CWE-862). Publicly available exploit code exists, but the issue is not listed as confirmed actively exploited (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so the signals are consistent and point to a moderate, not critical, priority for sites that actually run and rely on this plugin for checkout.
Unauthenticated attackers can overwrite arbitrary options in the Social Web Suite WordPress plugin through version 4.1.12 by abusing a settings-write endpoint that performs no authorization check, with the most damaging target being the shared secret that guards the plugin's own privileged endpoints. Because the CVSS vector is PR:N/UI:N, no credentials, privileges, or user interaction are required; the only precondition is that the plugin be installed and active on an internet-reachable WordPress site, and default configurations are affected. Impact is confined to integrity (C:N/I:L/A:N, base 5.3) rather than direct code execution or data disclosure, but public exploit code exists in the form of the WPScan proof-of-concept, so weaponization by opportunistic scanners is plausible. EPSS is low at 0.14% (3rd percentile), and there is no indication of confirmed active exploitation in CISA KEV; treat this as a moderate-priority stepping-stone issue rather than a catastrophic flaw.
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.
Stored cross-site scripting in the Zotpress WordPress plugin through 7.4.4 allows an authenticated low-privilege user to inject persistent JavaScript that executes when another user views the affected page. The assessed CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and no public exploit code or confirmed active exploitation was identified in the provided intelligence. Because exploitation requires a low-privilege account plus victim interaction, risk is highest on multi-author WordPress sites, while single-admin or closed-registration blogs have a reduced attack surface.
Missing authorization in the Creator LMS WordPress plugin (versions through 1.2.21) lets unauthenticated remote attackers invoke plugin functionality that should require elevated privileges, producing a limited integrity impact - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) confirms no authentication, no user interaction, and no confidentiality or availability loss. Any WordPress site running the affected plugin version that is reachable over the network is exposed, with default configurations affected. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was included in the supplied intelligence, so the practical risk is best characterized as moderate and dependent on whether the plugin is installed and exposed.
Stored cross-site scripting in the WordPress plugin WP Plugin Info Card (all versions through 6.3.5) lets an authenticated user with low-level posting privileges place a malicious script into content that the plugin later renders as an info card, so the payload executes in the browser of any user who views the affected page. Successful exploitation requires two separate conditions: the attacker must already hold a WordPress account able to create or edit the relevant content (PR:L), and a victim - typically an administrator or another site user - must subsequently view the rendered card (UI:R); the flaw is not reachable by fully unauthenticated attackers and does not fire automatically. Patchstack rates it CVSS 6.5, and there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the practical exposure is limited to sites running the plugin with multiple content-authoring accounts.
Unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the Visual Composer Website Builder WordPress plugin (versions through 45.16.3) to access information they should not be able to reach. The vulnerability is rated CVSS 5.3 with network attack vector, no privileges required, and no user interaction, but only low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the StellarWP Event Tickets WordPress plugin (versions through 5.30.0.1) allows attackers to manipulate a user-controlled object key - such as a ticket, order, or attendee identifier - so that records they do not own can be located and altered, because the affected endpoint performs no server-side ownership check. The flaw is rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, confining impact to the integrity of specific records with no confidentiality or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the effective privilege requirement should be validated because comparable WordPress-plugin IDORs frequently require at least a low-privileged authenticated session despite a PR:N vector.
Missing authorization in Event Tickets 5.30.0.1 and earlier allows an authenticated low-privileged WordPress user, such as a subscriber or customer, to perform a restricted event-ticket action they should not be authorized to perform. The affected product is the Liquid Web/StellarWP Event Tickets WordPress plugin, and the issue carries a moderate CVSS score of 4.3 with only low integrity impact and no confidentiality or availability impact. Exploitation requires a valid login but no victim interaction, and no public exploit identified at time of analysis.
Stored cross-site scripting in Gutenberg Blocks by Kadence Blocks (also distributed as Kadence Blocks) affects WordPress installations running version 3.7.12 or earlier, allowing an authenticated user with contributor- or author-level posting rights to embed malicious script content inside Kadence blocks that executes when a higher-privileged user - typically an administrator or editor - later views or previews the affected post. Because the injected script runs in the privileged user's session, the attacker can hijack administrative actions, inject further content, or persist access, although exploitation depends on both obtaining a content-creation account and a privileged victim rendering the poisoned content. No public exploit code has been identified at time of analysis and there is no indication of active exploitation (CISA KEV); the issue is assessed as moderate priority rather than top-tier.
Low-privilege authenticated users can bypass authorization on Event Tickets (a WordPress plugin by Liquid Web / StellarWP) versions up to and including 5.30.0.1, reaching functionality that lacks a proper capability check and thereby reading or modifying event and ticket data they should not control. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CWE-862) - exploitation requires only any valid logged-in account, such as a self-registered subscriber or ticket purchaser, so sites that permit open registration carry the most exposure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the Patchstack advisory makes the weakness straightforward to probe for on unpatched installations.
Stored cross-site scripting in the Robo Gallery WordPress plugin (versions through 5.1.6) lets an authenticated low-privilege user - such as a contributor or author with posting rights - persist malicious JavaScript into gallery content, which then executes in the browser of any user who later views the affected page, typically an administrator. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) because the payload can alter the rendering scope and requires victim interaction to fire, the practical exposure is limited to sites that grant untrusted accounts the ability to create or edit Robo Gallery content. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the issue was reported via Patchstack.
Medium-severity (CVSS 6.5) missing authorization flaw (CWE-862) in BdThemes Ultimate Post Kit WordPress plugin versions up to and including 4.5.5 allows an authenticated low-privilege user (such as a subscriber or contributor) to access a plugin function or endpoint that lacks proper authorization checks, resulting in high confidentiality impact (information disclosure) with no integrity or availability impact. Exploitation requires the target site to allow low-privileged accounts; sites that disable open registration or restrict such roles are not affected. No public exploit identified at time of analysis.
Stored cross-site scripting in the MasterStudy LMS WordPress plugin (versions through 3.7.52) allows an authenticated attacker with a low-privilege role, such as a student or instructor, to inject persistent JavaScript that executes when a privileged user views the affected page or dashboard view. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); exploitation requires victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in the WP Store Locator WordPress plugin through version 3.0.3 allows an authenticated low-privilege user to inject script that is persisted and later rendered without neutralization, executing in the browser of a privileged victim who views the affected page. The assessed CVSS 3.1 base score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a network-reachable flaw that requires a valid low-privilege account (PR:L) and victim interaction (UI:R) rather than unauthenticated access. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE, so real-world exploitation is constrained by the need for an authenticated foothold and for an administrator or editor to actually view the attacker-controlled content.
Missing authorization checks in the VillaTheme Core WordPress plugin, affecting versions up to and including 1.0.5, allow an authenticated low-privilege user to reach plugin functionality that should require higher capabilities, resulting in limited information disclosure. The flaw carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and per the assessed vector is not exploitable by unauthenticated users - an account on the WordPress site is a prerequisite (PR:L). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is limited to low confidentiality exposure with no integrity or availability effect, making this a moderate, low-priority issue.
Stored cross-site scripting in ShortPixel Image Optimizer versions through 6.5.6 allows an authenticated low-privileged WordPress user to inject JavaScript that executes when a higher-privileged victim views the affected plugin-generated page. The vulnerability is a CWE-79 improper-neutralization issue in a WordPress plugin, requires the plugin to be installed and active, and is not remotely exploitable by an unauthenticated attacker against a default install. No public exploit identified at time of analysis, and no EPSS score was supplied; the assessed severity is moderate with scope change and limited confidentiality and integrity impact.
Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
Authorization bypass in the WordPress plugin HollerBox (Groundhogg) through version 2.3.14 allows unauthenticated remote attackers to manipulate plugin-managed objects by supplying a user-controlled key that the plugin fails to validate against ownership or access level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms no authentication or user interaction is required and impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV).
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Unauthenticated attackers can bypass disabled user registration in Easy Digital Downloads WordPress plugin versions before 3.7.1 to create a WordPress account and obtain a logged-in session, with the new user assigned the site's default role. Publicly available exploit code exists, and the independent assessment rates this as a moderate-priority issue (CVSS 5.3) rather than a critical emergency, because the impact is largely determined by the default role-typically a low-privilege Subscriber. Sites that rely on disabled registration for protection are directly exposed, while those with registration already enabled see little added risk.
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 accepts forged payment notifications and marks orders as paid when no webhook secret has been configured, allowing unauthenticated remote attackers to obtain goods or services without completing payment. The flaw is a business-logic integrity issue rather than a system-compromise bug: CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to falsified order/payment state. It is exploitable only on stores that have left the webhook secret empty, and publicly available exploit code exists (WPScan); there is no evidence of confirmed active exploitation in the wild.
Unauthenticated information disclosure in the Track Orders for WooCommerce WordPress plugin before 1.2.7 lets anyone who already knows a customer's email address retrieve that customer's name, email, phone number, postal address and order history from the plugin's order-tracking lookup. The lookup returns billing details without ever verifying that the requester owns the referenced order, and because the CVSS vector confirms PR:N and UI:N, no account or interaction is needed - the only gating factor is prior possession of a valid customer email. No public exploit identified at time of analysis and no confirmed active exploitation (the flaw is not listed in CISA KEV), but CISA's SSVC assessment marks it automatable, and the vendor has released a fix in version 1.2.7.
Cross-site user data disclosure in the SMS Alert WordPress plugin before 4.0.1 allows an administrator of one subsite on a WordPress multisite network to retrieve stored billing phone numbers belonging to users of other subsites on that network. The flaw only affects multisite installations, and exploitation further requires the SMS Alert SMS gateway credentials to be configured and stored on the acting administrator's own site; the attacker must already hold administrator privileges on at least one subsite (CVSS vector PR:H, authenticated), so this is realistically a cross-tenant disclosure by a trusted or compromised admin rather than unauthenticated remote exploitation. Scoring is low (vendor score 2.7; our assessment is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV); patched plugin version 4.0.1 is available from the vendor.
Insufficient authorization in the Wallet System for WooCommerce WordPress plugin before 2.8.0 lets any authenticated user - a subscriber-level account is sufficient - file a withdrawal request against another user's wallet while freely choosing the amount and the payout destination. Because the plugin never checks that the wallet named in the submission belongs to the submitter, the attacker can also repeatedly lodge requests that indefinitely block the victim from making legitimate withdrawals of their own, producing an immediate denial-of-service effect even when no funds move. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; wallets with balances are the meaningful targets, and actual fund transfer typically still depends on an administrator approving the payout.
Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). Stores with open customer registration and the wallet-transfer feature enabled are directly exposed; no public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Information disclosure in the Wallet System for WooCommerce plugin before 2.8.0 allows any authenticated user on a WordPress site - the description states a subscriber-level account is sufficient - to generate and download a report containing every customer's wallet transaction history, including names, email addresses, user roles, transaction amounts, payment methods and dates. The report endpoint performs no capability check and instead trusts a token that the plugin renders on a front-end page, so any logged-in user can retrieve the token and then invoke the endpoint; no user interaction is required. The published base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while our assessment rates the confidentiality impact as High (C:H) because the exposure covers complete customer PII and the store's full financial transaction ledger. No public exploit code identified at time of analysis; patch available in 2.8.0.
Path traversal in the BackWPup WordPress plugin before 5.7.7 lets a high-privileged, authenticated user (PR:H, typically a WordPress administrator with backup/restore permissions) write files outside the intended restore directory by supplying a crafted backup archive during a restore that runs through the plugin's fallback archive library, which can escalate to remote code execution. The CVSS 3.1 base score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high privileges and the non-default fallback-library code path required rather than a broad unauthenticated attack surface. A vendor patch is available in BackWPup 5.7.7, and no public exploit code was identified at time of analysis; exploitation is not confirmed as active (no CISA KEV listing).
Unauthenticated attackers can force any pre-existing backup job in the BackWPup WordPress plugin (versions 3.3 through 5.7.6) to execute immediately by sending a request straight to its cron-triggered backup execution handler, which does not confirm the request originated from WordPress's internal scheduled-event dispatch. The attacker cannot create, edit, or delete jobs and gains no access to backup contents, so the practical impact is confined to unscheduled job execution and the resulting resource consumption rather than data exposure. No public exploit code or confirmed active exploitation was identified at the time of analysis, and EPSS data was not supplied; the vendor fixed the issue in BackWPup 5.7.7.
Information disclosure in the BackWPup WordPress plugin before 5.7.7 lets unauthenticated remote attackers download a complete backup archive - database dump, site files, credentials and secret keys - left behind in the plugin's working directory by an interrupted restore. Exploitation is conditional: it requires the site to run a webserver that does not enforce .htaccess restrictions (explicitly NGINX) plus an interrupted restore that left the archive in place, which is why the assessed vector carries AC:H despite PR:N, AV:N. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), so this rates as a genuine but conditional information-disclosure flaw rather than an emergency, though the high confidentiality impact of leaked database and secret-key material warrants prompt patching.
Deletion of stored form entries in the WordPress plugin Database Addon for WPForms (also distributed as 'wpforms entries') is possible against any site running a version before 1.1.1, because the entry-removal handler fails to validate a CSRF nonce when that field is omitted and performs no capability check of its own. An attacker can host a crafted page that, when loaded by a logged-in WordPress administrator, silently submits the deletion request on the victim's behalf; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network reachability and low complexity but gates success on administrator interaction. Impact is integrity-only (C:N/I:L/A:N, CVSS 4.3 Medium) and limited to removal of stored form submissions, with no code execution, data disclosure, or site availability loss; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Unauthenticated visitors can retrieve any customer's name, contact details, and order confirmation code from WordPress sites running the Appointment Booking Plugin before version 5.7.3 due to an insecure direct object reference (IDOR, CWE-639) in the order confirmation summary flow. The plugin fails to verify that the caller owns the order referenced by a sequential order-item identifier, allowing enumeration of all booking confirmations. No public exploit has been identified at time of analysis, but the predictable identifiers make the flaw trivially exploitable whenever booking orders exist, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms it is network-reachable without authentication or user interaction.
Irreversible deletion of orders, customers, and transactions stored by the Appointment Booking Plugin for WordPress is possible for authenticated backend staff users in all versions before 5.6.5, because the plugin's deletion routine never confirms that the acting staff account is authorized for the specific record it is asked to remove. An attacker holding a record-scoped staff role (for example, a staff member whose scope is limited to their own appointments) can supply an arbitrary record identifier and destroy data belonging to other staff or entirely outside their assigned scope, and the deletion cannot be undone. The vulnerability is network-reachable and requires no user interaction, but the principal barrier is the prerequisite of an existing backend staff login, which keeps the practical risk low and consistent with the vendor's 2.7 score; no public exploit code has been identified at time of analysis.
Authenticated agents can bypass per-record authorization in the Appointment Booking Plugin (LatePoint) before 5.6.9, enabling them to read and modify other agents' profile data and read other agents' bookings and customer details when the optional AI Abilities API feature is enabled. The flaw is a CWE-639 authorization bypass via user-controlled keys. No public exploit code or active exploitation has been identified, and the assessed CVSS is low (3.3) due to the requirement for an authenticated agent account and the optional feature.
Booking Calendar, a WordPress plugin, fails to restrict which WordPress options a lower-privileged user can retrieve through one of its settings handlers, so an authenticated account holding the Editor role or higher can read the values of arbitrary entries in the site's options table - including core site configuration - in plugin versions from 10.15 up to but not including 11.8.3. The issue is rated CVSS 3.1 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable but high-privilege-only path with limited confidentiality impact and no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is concentrated on sites that hand Editor-level access to untrusted or compromised accounts. A vendor-released patch exists: 11.8.3.
Authenticated information disclosure in the Easy Digital Downloads WordPress plugin before 3.7.1 allows any subscriber-level account to read other customers' recent order contents and harvest signed download links that grant free access to paid digital files. The flaw rates CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200) because exploitation requires a valid low-privilege login, making it most dangerous on sites that allow open or self-service registration. No public exploit identified at time of analysis; vendor-released patch: 3.7.1.
Predictable per-booking access hashes in the Booking Calendar WordPress plugin before 11.8 let unauthenticated attackers read a booking's personal data or modify the booking in place, provided they can determine or closely estimate when that booking was created. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting that no login or victim interaction is needed but that the attack is targeted and per-booking rather than mass-exploitable, since the low-entropy, time-seeded value behind each hash must be narrowed down first. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor remediation is available in version 11.8.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (versions before 3.6.14) lets an authenticated attacker with contributor-level access or above inject arbitrary JavaScript that runs in the browser session of anyone viewing the affected post. The flaw arises because several gallery configuration values can be overridden through the plugin's gallery shortcode and are printed unsanitised into an inline script block; because no gallery ownership is required, any gallery already present on the site can be referenced, and an administrator previewing a pending contributor submission is the most likely victim. Exploitation requires the victim to load the crafted post (UI:R), there is no public exploit identified at time of analysis, and a vendor-released patch in version 3.6.14 is available.
Authenticated WordPress users holding contributor-level access or higher can clone, modify, reorder, and write plugin metadata onto galleries and images owned by other users on any site running the Image Photo Gallery Final Tiles Grid plugin before 3.6.14. The root cause is incomplete object-ownership verification in the plugin's gallery and image management actions, where authorization is checked against a different object than the one being acted on or omitted entirely, producing a low-integrity authorization bypass with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and real-world risk is low because an attacker must already possess a contributor account on the target site; a vendor-released patch is available in version 3.6.14.
Authenticated attackers holding only Subscriber-level access can tamper with the personal records of arbitrary LatePoint customers on WordPress sites running the Appointment Booking & Reservation plugin through version 5.6.9. The process_step_customer() handler merges attacker-supplied POST data into an existing customer record while checking only is_user_logged_in(), so any logged-in account can rewrite another customer's first name, last name, email, phone, and notes; where the non-default contact_merge setting is 'phone', this escalates to overwriting the victim's email and enabling account takeover via password reset. Exploitation requires a valid low-privilege session (PR:L), which is trivial on sites with open registration, and there is no public exploit identified at time of analysis, though the EPSS-style risk is moderate rather than critical.
Stored cross-site scripting in the Aurora Heatmap WordPress plugin affects all versions up to and including 1.7.2 and lets unauthenticated attackers inject arbitrary JavaScript through the plugin's 'url' parameter, with the payload firing in an administrator's browser whenever that admin clicks the injected heatmap link. The flaw is rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to plant the payload but a successful attack depends on an administrator later interacting with the malicious link; impact is limited to information disclosure and limited integrity within the admin's browser session, with no availability impact. There is no public exploit identified at time of analysis, and the plugin should be treated as untrusted until a fixed build is confirmed. An upstream Trac changeset (3712276) indicates code changes addressing the issue, but no patched release version has been independently confirmed.