WordPress
Monthly
WP Rentals theme through 3.14.2 contains a missing authorization flaw (CWE-862) that lets unauthenticated remote attackers trigger unauthorized state-changing actions through incorrectly configured access controls. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates no authentication, no user interaction, and only low integrity impact, with no confidentiality or availability impact, making this a moderate-priority issue rather than a top-tier emergency. No public exploit identified at time of analysis, and default installations running affected versions are exposed.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Unauthenticated information disclosure in the WP Chill Modula Image Gallery WordPress plugin (modula-best-grid-gallery) through version 3.0.11 lets remote attackers retrieve embedded sensitive data from a site without logging in or triggering any user interaction. The missing authorization check (CWE-862) affects an exposed plugin route, but impact is limited to low-confidentiality read access - there is no ability to modify content or execute code. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this is a moderate, not high, priority; any network-reachable WordPress site running the vulnerable plugin build is exposed, while sites on a patched release or without the plugin active are unaffected.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions through 3.50.0) allows an authenticated low-privilege user to plant JavaScript that runs in the browser of any higher-privileged user who views the affected page. Rated CVSS 6.5 (Medium), the flaw requires an existing contributor-level account plus victim interaction, so it is not exploitable by anonymous remote attackers against a default installation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no fixed version is documented in the available advisory data.
Stored cross-site scripting in the BdThemes Prime Slider plugin for WordPress (versions through 4.6.2) allows authenticated users with contributor-level access or higher to inject persistent JavaScript into slider widgets, which executes in the browser of any higher-privileged user who views the affected page. This medium-severity flaw (CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requires a valid low-privileged account and victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Quiz And Survey Master (quiz-master-next, by ExpressTech) through version 11.2.7 allows an authenticated low-privilege user to persist malicious markup that executes in the browser of whoever later views the affected quiz or survey content. The plugin stores user-supplied input in quiz and survey fields and renders it back without adequate neutralization, so a contributor-level account that can submit quiz/survey data can target higher-privileged viewers such as administrators reviewing entries; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, giving a medium-severity score of 6.5, reported by Patchstack. No public exploit code identified at time of analysis, and the issue is not listed in CISA KEV; because the attacker needs a working WordPress account and the victim must open the crafted page, exploitation is a realistic but non-trivial, interaction-dependent risk for sites that expose quiz/survey submission to low-privilege roles.
Missing authorization checks in the WPMU DEV Hustle WordPress plugin (wordpress-popup) through version 7.8.14.2 allow an authenticated user holding only a low-privileged account to read data exposed by an access-control-protected feature that should be restricted to higher-privileged roles. The exposure is read-only - confidentiality is the only impacted property (CVSS 3.1 score 4.3, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - and requires no user interaction and no administrative rights, so the practical barrier is simply having any valid account on the target site. There is no public exploit code identified at time of analysis and the issue is not flagged as actively exploited, so this should be handled as a routine patch item rather than an emergency; sites that permit open user registration face the greatest exposure.
Stored cross-site scripting in the WP Media Rocket Lazy Load WordPress plugin (versions through 2.4.0) allows an authenticated low-privileged user to inject persistent JavaScript that executes in the browser of any visitor, including administrators, who later views the affected page. The issue is rated CVSS 6.5 (medium) with mandatory victim interaction and a changed scope; no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Stored cross-site scripting in Element Pack Elementor Addons (bdthemes-element-pack-lite) through version 8.8.6 allows a low-privileged authenticated WordPress user to plant persistent script payloads inside Elementor widget content, which then execute in the browser of any higher-privileged user - typically an administrator or editor - who later renders the affected page. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) confirms that reachability is network-based but the attack requires a pre-existing contributor-or-higher account plus victim interaction, so single-admin sites are far less exposed than multi-author, editorial, or client-managed WordPress deployments. No public exploit code and no CISA KEV entry were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored cross-site scripting (XSS) in Element Pack Elementor Addons through version 8.8.6 allows authenticated users with low-level privileges to inject malicious scripts into pages via vulnerable widgets or input fields. The injected payload executes when a higher-privileged user views the compromised page, potentially leading to session hijacking or site takeover. No public exploit identified at time of analysis, and no vendor-released patch is specified in the provided data.
Unauthenticated email relay in the Magee Shortcodes WordPress plugin (versions through 2.1.1) allows remote attackers to send arbitrary emails to any address through an affected site, because the plugin does not restrict the recipient of some of its unauthenticated contact-form actions. Any WordPress site running the plugin with a page that renders one of its contact-form shortcodes is exposed; sites with the plugin installed but no such page are substantially less exposed, since the vulnerable action endpoint is not reachable. No authentication (PR:N) and no user interaction (UI:N) are required, publicly available exploit code exists, and there is no CISA KEV confirmation of active exploitation. The impact is limited to mail abuse - the assessed vector (C:N/I:L/A:N) reflects no data disclosure, no code execution and no denial of service, making this a moderate abuse-of-functionality issue rather than a system compromise.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.
Server-side request forgery in the PowerPress Podcasting plugin by Blubrry (versions 11.13.12 through before 11.17.11) lets authenticated WordPress users with contributor-level access or higher supply a media URL that the plugin fetches server-side, following HTTP redirects to attacker-chosen destinations, and thereby probe or reach internal services. The flaw is a redirect-destination validation failure classified as CWE-918 with CVSS 4.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N per the assessed vector), so impact is limited to confidentiality-oriented access to internal endpoints with no direct write or code-execution path indicated. Publicly available exploit code exists for this issue, but there is no confirmed active exploitation (CISA KEV) and no evidence of a zero-day; the vendor has released a patch, and this is a moderate, not urgent, priority.
Email address disclosure in the User Private Files WordPress plugin before version 2.1.9 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email address of any registered account on the site, including administrators. The plugin fails to verify that a supplied user actually belongs to the document being operated on, so an attacker with a valid account can simply supply arbitrary user identifiers and read back the associated email addresses. Publicly available exploit code exists (documented by WPScan), no CISA KEV entry confirms active exploitation, and the impact is limited to confidentiality (CVSS 4.3, C:L) with no data modification or service disruption - making this a genuine but low-to-moderate priority issue rather than a critical one.
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service credentials to any authenticated user, including the lowest-privilege Subscriber role, because the account dashboard widget renders that data without a capability check. Exploitation requires only a valid account on the affected site and no user interaction, giving a complete confidentiality loss (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with the practical risk driven mostly by whether open self-registration lets an outsider obtain the required Subscriber session. Publicly available exploit code exists and the vendor shipped a patch in 4.2.15; this issue is not confirmed actively exploited (CISA KEV) and should be treated as a legitimate medium-severity flaw rather than a high-urgency threat.
Unauthenticated attackers can read WooCommerce product sales counts, exact stock levels, and private product meta from WordPress sites running the WPCafe plugin before version 3.0.21, because several of the plugin's REST API endpoints fail to enforce the access restrictions WooCommerce applies to that same data. CVSS 3.1 scores the flaw 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable, credential-free, read-only disclosure with limited confidentiality impact, and publicly available exploit code exists. The real-world blast radius depends on the target also running a populated WooCommerce store, since without WooCommerce product data there is nothing meaningful to leak.
SQL injection in the MPG WordPress plugin before 4.2.3 allows authenticated users holding the Editor role or higher to inject crafted data through the plugin's project-import functionality, causing sensitive records such as WordPress password hashes to be read out of the database. The flaw is CWE-89: imported project data is not structurally validated before it is concatenated into a database query. Publicly available exploit code exists (per WPScan and the CVE.org reference), though the vulnerability is not confirmed actively exploited (CISA KEV), and its practical reach is bounded by the PR:H vector - anonymous visitors and low-privilege accounts (Subscriber, Contributor) cannot trigger it. Upgrading to version 4.2.3 removes the condition.
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
Second-order SQL injection in the Animated Number Counters WordPress plugin before version 3.1 allows an attacker with an Editor-level account to store a crafted counter value that is later concatenated into an SQL query and executed when any unauthenticated visitor loads a page containing the counter, enabling extraction of arbitrary database contents including password hashes. The flaw requires an existing Editor account (authenticated, high privileges) for the initial injection, but the malicious SQL runs without further authentication. A vendor patch (version 3.1) is available, and publicly available exploit code exists; the assessed CVSS vector (6.8, PR:H, scope changed) reflects the privileged prerequisite and high confidentiality impact.
Authenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author role or higher to inject arbitrary web scripts through unsanitized gallery display configuration values, which are stored and later rendered into an image tag attribute. The injected script executes when any visitor, including an administrator, views a page containing the affected gallery; exploitation requires an authenticated low-privilege account and a victim page view. Publicly available exploit code exists, but no CISA KEV active-exploitation flag is provided; the independent assessment rates it as requiring Author+ access with user interaction and limited confidentiality/integrity impact.
Stored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Author role or higher to store a malicious gallery item identifier that is output unsanitized in an image tag attribute, causing script execution when any visitor, including an administrator, views a page embedding the gallery. Publicly available exploit code exists for this issue, but it is not listed in CISA KEV in the provided data; the vendor has released a patch in version 1.16.1. The input rates this CVSS 6.8 (Medium), while the independent assessment vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
WordPress through version 7.1.2 contains an information disclosure flaw (CWE-201) that allows unauthenticated remote attackers to retrieve embedded sensitive data from server responses. The vulnerability, reported by Patchstack, has a CVSS 4.0 base score of 6.9, reflecting high exploitability but low confidentiality impact; no public exploit identified at time of analysis. The affected version 7.1.2 does not match any known public WordPress core release, so the actual vulnerable scope may be narrower or misreported.
Unauthenticated information disclosure in the StylemixThemes Motors WordPress plugin (car dealership and classified-listings plugin, all versions through 1.4.124) allows any remote visitor to retrieve sensitive data that the plugin embeds into the responses it sends to clients - for example internal configuration values, tokens, or other embedded secrets surfaced in rendered pages or AJAX/REST output. The CVSS 4.0 base score of 6.9 reflects a network-reachable, no-privilege, no-user-interaction, no-configuration-dependency attack path where the only impact is low-sensitivity confidentiality loss (VC:L, with no integrity or availability effect and no subsequent-system impact). No public exploit code has been identified at time of analysis and the CVE is not associated with CISA KEV, so exploitation is not confirmed as active.
Broken access control in the Delete All Comments WordPress plugin through version 7.1 allows any authenticated subscriber-level account to invoke bulk comment-deletion functionality without the required capability check, causing high availability impact to comment data on affected sites. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms remote, low-privilege exploitation with no user interaction, while confidentiality and integrity are unaffected; this is a moderate, not critical, priority. No CISA KEV confirmation and no public exploit identified at time of analysis are present in the supplied intelligence, and exploitation is realistic mainly where self-registration or obtainable subscriber credentials exist.
Zero Spam plugin versions up to 5.7.11 for WordPress can be bypassed by unauthenticated attackers to defeat its anti-spam protections, allowing forged or unwanted form submissions. This moderate-severity (CVSS 5.3) authentication bypass (CWE-290) requires no authentication or user interaction, but its impact is limited to integrity (I:L) - no data confidentiality or availability loss, and no code execution or site takeover. No public exploit or active exploitation is identified at time of analysis.
Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated settings modification in the PayPlug for WooCommerce (Official) WordPress plugin at versions up to and including 3.1.0 lets any network-reachable attacker invoke the plugin's settings-change functionality without credentials or user interaction, altering configuration data on affected WooCommerce stores (CVSS 6.5, PR:N/UI:N with limited integrity and availability impact). The root cause is a missing authorization check (CWE-862), which means the plugin exposes a settings endpoint that does not verify capability or nonce before applying changes. At time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); successful abuse remains limited to sites that have this specific plugin installed, active and reachable at an affected version, and the impact is scoped to settings modification rather than full site compromise.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
Remote unauthenticated attackers can access sensitive information on WordPress sites running the Mailjet Email Marketing plugin version 6.2.3 or earlier. The flaw, rated CVSS 5.3, stems from insertion of sensitive data into sent responses (CWE-201), affecting confidentiality only; no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation requires only that the vulnerable plugin be installed and network-reachable, as the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated access with no user interaction.
Stored cross-site scripting in the Front End PM WordPress plugin (versions 11.4.6 and earlier) lets an attacker holding a low-privileged Subscriber account inject script payloads through plugin input such as private messages or profile fields, which then execute in the browser of a higher-privileged user who views the content. The flaw is rated CVSS 6.5 (medium, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), meaning the attacker must be authenticated and the victim must actively open the tainted content, so exposure is concentrated on sites that permit open or self-service user registration. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; Patchstack published the finding and no vendor fix version is confirmed in the available data.
Unauthenticated broken access control in the 10Web Social Photo Feed WordPress plugin (versions 1.4.35 and earlier) allows remote attackers to reach plugin functionality that should require authorization, giving limited read and write access to plugin-controlled data rather than full site compromise (CVSS 6.5, CWE-862, C:L/I:L/A:N). The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable at low complexity, so any site with the vulnerable plugin active is exposed without credentials. Exploitation is bounded by the Low confidentiality and integrity impact and by the need for the specific plugin/version; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Captcha bypass in the WordPress plugin Captcha by BestWebSoft (versions 5.2.8 and earlier) lets unauthenticated remote attackers defeat the plugin's anti-automation challenge on any form it protects, including login, registration, comment and password reset, without user interaction. Classified as CWE-290 (authentication bypass by spoofing) and scored CVSS 5.3, the issue degrades only integrity of the protected workflow: bypassing the captcha removes a defense-in-depth control but does not itself grant account access or expose data. No public exploit identified at time of analysis, and real-world severity depends on which forms the plugin guards and whether separate rate-limiting, MFA or WAF controls are active.
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.
Unauthenticated broken access control in the Autoship Cloud for WooCommerce Subscription Products plugin through version 2.17.0 lets remote attackers reach plugin functionality that should require authorization, allowing unauthorized actions that degrade the integrity and availability of subscription-related operations (CVSS 6.5, C:N/I:L/A:L). The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, so the only real prerequisites are that a vulnerable plugin version be installed, active, and reachable over the network on a WordPress/WooCommerce site. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is a moderate, patch-on-schedule issue rather than a top-tier emergency.
Unauthenticated IDOR in the Wappointment appointment-booking plugin for WordPress (all versions through 2.7.7) allows remote attackers to access and tamper with appointment records they do not own by supplying or enumerating object identifiers that the plugin fails to authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) confirms no authentication, privileges, or user interaction are needed, so any network-reachable WordPress site running the plugin at or below 2.7.7 is exposed; impact is bounded to partial confidentiality and integrity loss with no availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was provided, making this a moderate-priority issue rather than an emergency - though unauthenticated Internet exposure and the ease of identifier enumeration keep it worth prompt attention.
Authenticated path traversal in the Piotnet Addons for Elementor WordPress plugin (versions up to and including 7.1.71) lets a Contributor-level account read and download arbitrary files from the host, exposing wp-config.php credentials, backups, and other sensitive data (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is confidentiality-only - an attacker gains no ability to write, modify, or disrupt the site - and it requires a valid Contributor login, so exposure is concentrated on sites that allow open registration or hand Contributor roles to untrusted users. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Patchstack is the reporting source through its WordPress vulnerability database.
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.
Stored/reflected cross-site scripting in WC Fields Factory 4.1.12 and earlier allows authenticated subscriber-level attackers to inject script that executes when a higher-privileged user views the affected field content. The plugin is a WooCommerce add-on for WordPress, and successful exploitation can lead to session theft, administrative actions performed in the victim's browser, or content manipulation, though the requirement for a subscriber account and victim interaction substantially narrows practical risk. CVSS 6.5; no public exploit identified at time of analysis, and no CISA KEV status is reported.
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Unauthenticated information disclosure in the Slider Pro WordPress plugin (versions 0 through 1.0.0) allows any remote visitor to call an AJAX action that performs no capability or authorisation check, returning the titles, excerpts, permalinks and media metadata of non-public posts such as drafts, pending, scheduled, private and trashed items, plus post revisions. The exposure is confined to metadata rather than full post bodies, which keeps the confidentiality impact limited (CVSS 3.1 base 5.3, Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect. Publicly available exploit code exists, but CISA's SSVC assessment records no active exploitation and no KEV listing applies.
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.
Unauthenticated attackers can manipulate order states in the Deema Payment Gateway WordPress plugin (versions through 1.1.2) by exploiting a missing payment verification step in the hosted-checkout return handler, causing orders to be marked as paid without any actual payment. The plugin fails to confirm transaction status or amount with the payment provider, and publicly available exploit code exists. With a CVSS score of 5.3 (MEDIUM), the impact is limited to integrity of order data, with no confidentiality or availability effects.
Unauthenticated attackers can mark unpaid orders as paid or cancel/refund existing orders on WordPress sites running the Deema Payment Gateway plugin through version 1.1.2, because the plugin fails to verify the authenticity of incoming payment provider notifications and ships with that verification disabled by default. The flaw is remotely exploitable without authentication (CVSS 5.3, CWE-287) and affects order integrity only, with no server compromise or data disclosure. Publicly available exploit code exists, but CISA SSVC indicates no observed exploitation; this is a genuine but moderate-priority issue rather than a critical emergency, and it should be patched or mitigated promptly.
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization checks in the WordPress plugin WDS MCP Content Manager (versions up to and including 3.10.4) let an authenticated Contributor-level user invoke functionality that should be reserved for higher-privileged roles, enabling limited unauthorized modification of plugin-managed content and settings. Exploitation requires only a Contributor account - a role that is trivially obtained on multi-author blogs and sites with open registration - needs no user interaction, and is reachable over the network, but the resulting impact is confined to a low-integrity change with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the 'Authentication Bypass' tag is somewhat overstated: this is an authenticated privilege/authorization gap, making it a low-to-moderate priority issue rather than a critical one.
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.
Missing authorization in the WordPress plugin WC Ukraine Shipping (wc-ukr-shipping) through version 1.23.2 lets an authenticated low-privilege user invoke plugin functionality that performs no capability check, allowing unauthorized modification of shipping configuration and related store data. The attack is network-reachable and requires no victim interaction, but it does require a valid session on the target site (PR:L) - a modest barrier that is often trivial to clear on WooCommerce stores that allow open customer registration, and the assessed impact is integrity-only with no confidentiality or availability effect. This is a moderate-risk, not top-priority, vulnerability: no public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure.
Authorization bypass in CozyThemes Cozy Blocks WordPress plugin versions up to 2.2.23 allows unauthenticated remote attackers to access data they are not authorized to view via an insecure direct object reference (IDOR). The flaw, rated CVSS 4.0 6.9 by Patchstack, requires no authentication or user interaction and results in low confidentiality impact only. No public exploit code has been identified at time of analysis.
Authorization bypass in Themeisle's AI Chatbot for WordPress - Hyve Lite plugin (versions through 2.0.2) allows unauthenticated remote attackers to modify chatbot-related records they do not own by supplying a user-controlled object identifier, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This is a moderate-severity IDOR (CWE-639) tracked as CVE-2026-97305 and scored CVSS 4.0 6.9; exploitation is limited to a Low integrity impact, with no confidentiality or availability effect, and no public exploit was identified at time of analysis.
Missing authorization in the Arraytics Timetics WordPress plugin (versions through 1.0.63) lets remote attackers trigger plugin actions that lack proper access-control checks, allowing limited integrity and availability impact on affected sites (CVSS 6.5, CWE-862). The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms exploitation is unauthenticated and requires no victim interaction, though the impact is bounded - no confidentiality loss - and any WordPress installation running the vulnerable plugin with the affected endpoint reachable is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Patchstack, and the affected range ends at 1.0.63.
Improper access control in the WP User Manager plugin for WordPress, affecting all versions through 2.9.20, allows remote attackers to reach user-management operations they are not authorized to perform, resulting in privilege abuse (CVSS 6.5, CWE-284). The published vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates unauthenticated, remote reachability with low confidentiality and integrity impact, although the Patchstack classification of this as a privilege-escalation issue suggests a pre-existing low-privileged WordPress account may be the practical prerequisite; that prerequisite should be confirmed against the vendor advisory. There is no indication of confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis; patch status is not established in the available data, so sites running the plugin should treat 2.9.20 and earlier as vulnerable pending a fixed release.
Missing authorization checks in the UsersWP WordPress plugin (all versions through 1.2.74) allow an authenticated low-privilege user to perform privileged actions that modify site data, with no user interaction required on the victim's part. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the barrier to exploitation is a valid low-privileged account - realistically a self-registered subscriber on sites that leave public registration open - after which the attacker gains a high-integrity impact without any data disclosure or denial of service. This is a moderate-risk broken access control (CWE-862) issue; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting (XSS) in the Webful Creations RepairBuddy WordPress plugin (computer-repair-shop) through version 4.1225 allows an authenticated attacker with low-level privileges to inject malicious JavaScript into fields such as repair tickets or customer records. The payload is stored and later executed when a privileged user views the affected page, potentially leading to session hijacking or unauthorized actions on behalf of the victim. Rated CVSS 6.5 (Medium), exploitation requires a valid account and victim interaction; no public exploit code has been identified at time of analysis.
Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin.
Reflected cross-site scripting (XSS) in the Adsmonetizer WordPress plugin (adsensei-b30) through version 3.2.4 allows remote attackers to inject arbitrary script into a victim's browser by convincing them to click a crafted link. The attacker does not need authentication, but exploitation requires user interaction and the targeted site must have the vulnerable plugin installed and reachable. This is rated CVSS 7.1, and no public exploit has been identified at time of analysis; it is not listed as confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
Unauthenticated remote attackers can tamper with limited plugin-controlled data in Kit (formerly ConvertKit) for WooCommerce versions up to 2.2.0 due to a missing authorization flaw, enabling unauthorized modification of certain settings or data. The vulnerability has a CVSS score of 5.3 with low integrity impact and does not require authentication or user interaction, though it cannot exfiltrate confidential data or cause denial of service. No public exploit identified at time of analysis, and patch availability is not confirmed.
Information disclosure in the WP SYNTEX Polylang WordPress plugin through 3.8.7 lets an authenticated low-privileged user bypass a missing authorization check (CWE-862) and retrieve embedded sensitive data they are not entitled to access. The issue carries a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): exploitation is network-reachable, low complexity and needs no user interaction, but requires a valid account with at least low privileges such as a default Subscriber, with no impact to integrity or availability. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so exposure is materially higher on sites that permit open user registration or host many low-trust accounts than on sites with restricted account creation.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.
Missing authorization checks in the WordPress plugin WP Dummy Content Generator (all versions through 4.0.0) let an authenticated low-privilege user - a subscriber or contributor, per the CVSS vector's PR:L - invoke plugin functionality that should be reserved for higher-privileged roles, producing a limited integrity impact (CVSS 3.1 score of 4.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, CWE-862). Exploitation requires the plugin to be installed and active and the attacker to hold valid credentials for a registrable low-privilege account, with no user interaction needed, and the effect is confined to modification of content the plugin manages rather than disclosure or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was supplied in the source data, so the residual risk is low-to-moderate and is highest on sites that permit open self-registration.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Unsafe reflection (CWE-470) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin through version 2.0.22 lets a low-privileged authenticated account steer which class or code the plugin loads, exposing information that account should not be able to read. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) confirms the attacker must hold a valid WordPress login with at least low privileges, that no user interaction is required, and that impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, so this is a moderate-severity authenticated information-disclosure issue rather than an emergency, though it is worth remediating because the authentication bar is low on multi-author and membership sites.
Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. There is no CISA KEV entry and no public exploit identified at time of analysis, so real-world priority is low-to-moderate; no EPSS score was supplied with the available intelligence.
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and including 11.17.9) let's remote attackers retrieve embedded sensitive data from an affected site because a function handling that data lacks a proper authorization check (CWE-862). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are required, but the impact is confined to confidentiality only, limited to specific embedded data rather than arbitrary site data, credentials, or any write capability. No confirmed active exploitation (CISA KEV) or publicly available exploit code has been identified at time of analysis, making this a genuine but low-to-moderate priority issue rather than an emergency; the exact vulnerable route is not specified in the source advisory, which constrains precise detection.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Authenticated low-privilege users can read and modify support tickets they do not own in the JS Help Desk WordPress plugin (Ahmad) through version 4.0.0, due to an insecure direct object reference (CWE-639) that exposes user-controlled ticket identifiers. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires a valid low-privilege account and is limited to confidentiality and integrity impact on support-ticket data, with no availability impact. No public exploit identified at time of analysis; no exploit code or KEV listing is referenced in the available intelligence.
Stored cross-site scripting in the WordPress plugin Name Directory (versions through 1.34.2) lets an authenticated attacker with low privileges (PR:L) save a script payload into directory content that executes in the browser of any user who later views the affected page (UI:R). Because the injected content persists, a single submission can fire for administrators or visitors on every subsequent page load, though the attacker must already hold an account able to author or edit Name Directory entries and the payload remains inert until someone else opens the page; per the CVSS vector PR:N is absent, so this is an authenticated-context issue rather than an unauthenticated one. The independent assessment rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with impact confined to browser-context script execution and no public exploit identified at time of analysis.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.
Stored cross-site scripting (XSS) in the LeapWorx Premium Addons for Elementor WordPress plugin, affecting versions through 4.11.109, allows an authenticated low-privileged user (contributor/author level, PR:L) to persist malicious script into plugin-handled content that executes in the browser of a higher-privileged victim who later views it (UI:R). Successful exploitation can lead to session theft, credential harvesting, or administrative actions performed in the victim's context, though it requires valid account access and victim interaction rather than being a zero-click or unauthenticated attack. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); EPSS data was not available for this CVE. The reported CVSS 3.1 base score is 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.
Missing authorization in the WordPress Name Directory plugin (through version 1.34.2) lets remote, unauthenticated attackers reach functionality and directory data that should require higher privileges or proper access-control checks. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects low-complexity, unauthenticated exploitation against default installs, with impact confined to low confidentiality loss and no integrity or availability effect, so the realistic outcome is unauthorized disclosure of directory entries rather than site takeover. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the primary practical exposure is limited to sites running the vulnerable plugin.
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.
Stored cross-site scripting in the Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (all versions through 5.14.2) lets an authenticated low-privilege user persist malicious script content that executes in the browser of any user who later views the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 6.5), meaning exploitation requires a valid account on the target WordPress site plus a victim who loads the rendered content, so real-world risk is concentrated on sites that grant accounts to untrusted or self-registered users. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available data.
Stored cross-site scripting in impleCode's eCommerce Product Catalog plugin for WordPress (versions through 3.6.2) allows an authenticated user holding only low-level privileges to plant malicious JavaScript in catalog content, which then executes in the browser of any user - typically an administrator - who views the affected catalog page. The issue is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the available intelligence shows no public exploit identified at time of analysis and no vendor-released patch version confirmed in the provided data. Real-world risk is constrained because the attacker needs some authenticated role on the target site and must wait for a victim to load the poisoned page, and the plugin has to be installed and active - it is a niche e-commerce plugin rather than a default WordPress component.
WP Rentals theme through 3.14.2 contains a missing authorization flaw (CWE-862) that lets unauthenticated remote attackers trigger unauthorized state-changing actions through incorrectly configured access controls. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates no authentication, no user interaction, and only low integrity impact, with no confidentiality or availability impact, making this a moderate-priority issue rather than a top-tier emergency. No public exploit identified at time of analysis, and default installations running affected versions are exposed.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Unauthenticated information disclosure in the WP Chill Modula Image Gallery WordPress plugin (modula-best-grid-gallery) through version 3.0.11 lets remote attackers retrieve embedded sensitive data from a site without logging in or triggering any user interaction. The missing authorization check (CWE-862) affects an exposed plugin route, but impact is limited to low-confidentiality read access - there is no ability to modify content or execute code. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this is a moderate, not high, priority; any network-reachable WordPress site running the vulnerable plugin build is exposed, while sites on a patched release or without the plugin active are unaffected.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions through 3.50.0) allows an authenticated low-privilege user to plant JavaScript that runs in the browser of any higher-privileged user who views the affected page. Rated CVSS 6.5 (Medium), the flaw requires an existing contributor-level account plus victim interaction, so it is not exploitable by anonymous remote attackers against a default installation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no fixed version is documented in the available advisory data.
Stored cross-site scripting in the BdThemes Prime Slider plugin for WordPress (versions through 4.6.2) allows authenticated users with contributor-level access or higher to inject persistent JavaScript into slider widgets, which executes in the browser of any higher-privileged user who views the affected page. This medium-severity flaw (CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requires a valid low-privileged account and victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Quiz And Survey Master (quiz-master-next, by ExpressTech) through version 11.2.7 allows an authenticated low-privilege user to persist malicious markup that executes in the browser of whoever later views the affected quiz or survey content. The plugin stores user-supplied input in quiz and survey fields and renders it back without adequate neutralization, so a contributor-level account that can submit quiz/survey data can target higher-privileged viewers such as administrators reviewing entries; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, giving a medium-severity score of 6.5, reported by Patchstack. No public exploit code identified at time of analysis, and the issue is not listed in CISA KEV; because the attacker needs a working WordPress account and the victim must open the crafted page, exploitation is a realistic but non-trivial, interaction-dependent risk for sites that expose quiz/survey submission to low-privilege roles.
Missing authorization checks in the WPMU DEV Hustle WordPress plugin (wordpress-popup) through version 7.8.14.2 allow an authenticated user holding only a low-privileged account to read data exposed by an access-control-protected feature that should be restricted to higher-privileged roles. The exposure is read-only - confidentiality is the only impacted property (CVSS 3.1 score 4.3, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - and requires no user interaction and no administrative rights, so the practical barrier is simply having any valid account on the target site. There is no public exploit code identified at time of analysis and the issue is not flagged as actively exploited, so this should be handled as a routine patch item rather than an emergency; sites that permit open user registration face the greatest exposure.
Stored cross-site scripting in the WP Media Rocket Lazy Load WordPress plugin (versions through 2.4.0) allows an authenticated low-privileged user to inject persistent JavaScript that executes in the browser of any visitor, including administrators, who later views the affected page. The issue is rated CVSS 6.5 (medium) with mandatory victim interaction and a changed scope; no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Stored cross-site scripting in Element Pack Elementor Addons (bdthemes-element-pack-lite) through version 8.8.6 allows a low-privileged authenticated WordPress user to plant persistent script payloads inside Elementor widget content, which then execute in the browser of any higher-privileged user - typically an administrator or editor - who later renders the affected page. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) confirms that reachability is network-based but the attack requires a pre-existing contributor-or-higher account plus victim interaction, so single-admin sites are far less exposed than multi-author, editorial, or client-managed WordPress deployments. No public exploit code and no CISA KEV entry were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored cross-site scripting (XSS) in Element Pack Elementor Addons through version 8.8.6 allows authenticated users with low-level privileges to inject malicious scripts into pages via vulnerable widgets or input fields. The injected payload executes when a higher-privileged user views the compromised page, potentially leading to session hijacking or site takeover. No public exploit identified at time of analysis, and no vendor-released patch is specified in the provided data.
Unauthenticated email relay in the Magee Shortcodes WordPress plugin (versions through 2.1.1) allows remote attackers to send arbitrary emails to any address through an affected site, because the plugin does not restrict the recipient of some of its unauthenticated contact-form actions. Any WordPress site running the plugin with a page that renders one of its contact-form shortcodes is exposed; sites with the plugin installed but no such page are substantially less exposed, since the vulnerable action endpoint is not reachable. No authentication (PR:N) and no user interaction (UI:N) are required, publicly available exploit code exists, and there is no CISA KEV confirmation of active exploitation. The impact is limited to mail abuse - the assessed vector (C:N/I:L/A:N) reflects no data disclosure, no code execution and no denial of service, making this a moderate abuse-of-functionality issue rather than a system compromise.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.
Server-side request forgery in the PowerPress Podcasting plugin by Blubrry (versions 11.13.12 through before 11.17.11) lets authenticated WordPress users with contributor-level access or higher supply a media URL that the plugin fetches server-side, following HTTP redirects to attacker-chosen destinations, and thereby probe or reach internal services. The flaw is a redirect-destination validation failure classified as CWE-918 with CVSS 4.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N per the assessed vector), so impact is limited to confidentiality-oriented access to internal endpoints with no direct write or code-execution path indicated. Publicly available exploit code exists for this issue, but there is no confirmed active exploitation (CISA KEV) and no evidence of a zero-day; the vendor has released a patch, and this is a moderate, not urgent, priority.
Email address disclosure in the User Private Files WordPress plugin before version 2.1.9 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email address of any registered account on the site, including administrators. The plugin fails to verify that a supplied user actually belongs to the document being operated on, so an attacker with a valid account can simply supply arbitrary user identifiers and read back the associated email addresses. Publicly available exploit code exists (documented by WPScan), no CISA KEV entry confirms active exploitation, and the impact is limited to confidentiality (CVSS 4.3, C:L) with no data modification or service disruption - making this a genuine but low-to-moderate priority issue rather than a critical one.
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service credentials to any authenticated user, including the lowest-privilege Subscriber role, because the account dashboard widget renders that data without a capability check. Exploitation requires only a valid account on the affected site and no user interaction, giving a complete confidentiality loss (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with the practical risk driven mostly by whether open self-registration lets an outsider obtain the required Subscriber session. Publicly available exploit code exists and the vendor shipped a patch in 4.2.15; this issue is not confirmed actively exploited (CISA KEV) and should be treated as a legitimate medium-severity flaw rather than a high-urgency threat.
Unauthenticated attackers can read WooCommerce product sales counts, exact stock levels, and private product meta from WordPress sites running the WPCafe plugin before version 3.0.21, because several of the plugin's REST API endpoints fail to enforce the access restrictions WooCommerce applies to that same data. CVSS 3.1 scores the flaw 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable, credential-free, read-only disclosure with limited confidentiality impact, and publicly available exploit code exists. The real-world blast radius depends on the target also running a populated WooCommerce store, since without WooCommerce product data there is nothing meaningful to leak.
SQL injection in the MPG WordPress plugin before 4.2.3 allows authenticated users holding the Editor role or higher to inject crafted data through the plugin's project-import functionality, causing sensitive records such as WordPress password hashes to be read out of the database. The flaw is CWE-89: imported project data is not structurally validated before it is concatenated into a database query. Publicly available exploit code exists (per WPScan and the CVE.org reference), though the vulnerability is not confirmed actively exploited (CISA KEV), and its practical reach is bounded by the PR:H vector - anonymous visitors and low-privilege accounts (Subscriber, Contributor) cannot trigger it. Upgrading to version 4.2.3 removes the condition.
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
Second-order SQL injection in the Animated Number Counters WordPress plugin before version 3.1 allows an attacker with an Editor-level account to store a crafted counter value that is later concatenated into an SQL query and executed when any unauthenticated visitor loads a page containing the counter, enabling extraction of arbitrary database contents including password hashes. The flaw requires an existing Editor account (authenticated, high privileges) for the initial injection, but the malicious SQL runs without further authentication. A vendor patch (version 3.1) is available, and publicly available exploit code exists; the assessed CVSS vector (6.8, PR:H, scope changed) reflects the privileged prerequisite and high confidentiality impact.
Authenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author role or higher to inject arbitrary web scripts through unsanitized gallery display configuration values, which are stored and later rendered into an image tag attribute. The injected script executes when any visitor, including an administrator, views a page containing the affected gallery; exploitation requires an authenticated low-privilege account and a victim page view. Publicly available exploit code exists, but no CISA KEV active-exploitation flag is provided; the independent assessment rates it as requiring Author+ access with user interaction and limited confidentiality/integrity impact.
Stored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Author role or higher to store a malicious gallery item identifier that is output unsanitized in an image tag attribute, causing script execution when any visitor, including an administrator, views a page embedding the gallery. Publicly available exploit code exists for this issue, but it is not listed in CISA KEV in the provided data; the vendor has released a patch in version 1.16.1. The input rates this CVSS 6.8 (Medium), while the independent assessment vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
WordPress through version 7.1.2 contains an information disclosure flaw (CWE-201) that allows unauthenticated remote attackers to retrieve embedded sensitive data from server responses. The vulnerability, reported by Patchstack, has a CVSS 4.0 base score of 6.9, reflecting high exploitability but low confidentiality impact; no public exploit identified at time of analysis. The affected version 7.1.2 does not match any known public WordPress core release, so the actual vulnerable scope may be narrower or misreported.
Unauthenticated information disclosure in the StylemixThemes Motors WordPress plugin (car dealership and classified-listings plugin, all versions through 1.4.124) allows any remote visitor to retrieve sensitive data that the plugin embeds into the responses it sends to clients - for example internal configuration values, tokens, or other embedded secrets surfaced in rendered pages or AJAX/REST output. The CVSS 4.0 base score of 6.9 reflects a network-reachable, no-privilege, no-user-interaction, no-configuration-dependency attack path where the only impact is low-sensitivity confidentiality loss (VC:L, with no integrity or availability effect and no subsequent-system impact). No public exploit code has been identified at time of analysis and the CVE is not associated with CISA KEV, so exploitation is not confirmed as active.
Broken access control in the Delete All Comments WordPress plugin through version 7.1 allows any authenticated subscriber-level account to invoke bulk comment-deletion functionality without the required capability check, causing high availability impact to comment data on affected sites. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms remote, low-privilege exploitation with no user interaction, while confidentiality and integrity are unaffected; this is a moderate, not critical, priority. No CISA KEV confirmation and no public exploit identified at time of analysis are present in the supplied intelligence, and exploitation is realistic mainly where self-registration or obtainable subscriber credentials exist.
Zero Spam plugin versions up to 5.7.11 for WordPress can be bypassed by unauthenticated attackers to defeat its anti-spam protections, allowing forged or unwanted form submissions. This moderate-severity (CVSS 5.3) authentication bypass (CWE-290) requires no authentication or user interaction, but its impact is limited to integrity (I:L) - no data confidentiality or availability loss, and no code execution or site takeover. No public exploit or active exploitation is identified at time of analysis.
Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated settings modification in the PayPlug for WooCommerce (Official) WordPress plugin at versions up to and including 3.1.0 lets any network-reachable attacker invoke the plugin's settings-change functionality without credentials or user interaction, altering configuration data on affected WooCommerce stores (CVSS 6.5, PR:N/UI:N with limited integrity and availability impact). The root cause is a missing authorization check (CWE-862), which means the plugin exposes a settings endpoint that does not verify capability or nonce before applying changes. At time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); successful abuse remains limited to sites that have this specific plugin installed, active and reachable at an affected version, and the impact is scoped to settings modification rather than full site compromise.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
Remote unauthenticated attackers can access sensitive information on WordPress sites running the Mailjet Email Marketing plugin version 6.2.3 or earlier. The flaw, rated CVSS 5.3, stems from insertion of sensitive data into sent responses (CWE-201), affecting confidentiality only; no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation requires only that the vulnerable plugin be installed and network-reachable, as the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated access with no user interaction.
Stored cross-site scripting in the Front End PM WordPress plugin (versions 11.4.6 and earlier) lets an attacker holding a low-privileged Subscriber account inject script payloads through plugin input such as private messages or profile fields, which then execute in the browser of a higher-privileged user who views the content. The flaw is rated CVSS 6.5 (medium, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), meaning the attacker must be authenticated and the victim must actively open the tainted content, so exposure is concentrated on sites that permit open or self-service user registration. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; Patchstack published the finding and no vendor fix version is confirmed in the available data.
Unauthenticated broken access control in the 10Web Social Photo Feed WordPress plugin (versions 1.4.35 and earlier) allows remote attackers to reach plugin functionality that should require authorization, giving limited read and write access to plugin-controlled data rather than full site compromise (CVSS 6.5, CWE-862, C:L/I:L/A:N). The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable at low complexity, so any site with the vulnerable plugin active is exposed without credentials. Exploitation is bounded by the Low confidentiality and integrity impact and by the need for the specific plugin/version; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Captcha bypass in the WordPress plugin Captcha by BestWebSoft (versions 5.2.8 and earlier) lets unauthenticated remote attackers defeat the plugin's anti-automation challenge on any form it protects, including login, registration, comment and password reset, without user interaction. Classified as CWE-290 (authentication bypass by spoofing) and scored CVSS 5.3, the issue degrades only integrity of the protected workflow: bypassing the captcha removes a defense-in-depth control but does not itself grant account access or expose data. No public exploit identified at time of analysis, and real-world severity depends on which forms the plugin guards and whether separate rate-limiting, MFA or WAF controls are active.
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.
Unauthenticated broken access control in the Autoship Cloud for WooCommerce Subscription Products plugin through version 2.17.0 lets remote attackers reach plugin functionality that should require authorization, allowing unauthorized actions that degrade the integrity and availability of subscription-related operations (CVSS 6.5, C:N/I:L/A:L). The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, so the only real prerequisites are that a vulnerable plugin version be installed, active, and reachable over the network on a WordPress/WooCommerce site. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is a moderate, patch-on-schedule issue rather than a top-tier emergency.
Unauthenticated IDOR in the Wappointment appointment-booking plugin for WordPress (all versions through 2.7.7) allows remote attackers to access and tamper with appointment records they do not own by supplying or enumerating object identifiers that the plugin fails to authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) confirms no authentication, privileges, or user interaction are needed, so any network-reachable WordPress site running the plugin at or below 2.7.7 is exposed; impact is bounded to partial confidentiality and integrity loss with no availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was provided, making this a moderate-priority issue rather than an emergency - though unauthenticated Internet exposure and the ease of identifier enumeration keep it worth prompt attention.
Authenticated path traversal in the Piotnet Addons for Elementor WordPress plugin (versions up to and including 7.1.71) lets a Contributor-level account read and download arbitrary files from the host, exposing wp-config.php credentials, backups, and other sensitive data (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is confidentiality-only - an attacker gains no ability to write, modify, or disrupt the site - and it requires a valid Contributor login, so exposure is concentrated on sites that allow open registration or hand Contributor roles to untrusted users. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Patchstack is the reporting source through its WordPress vulnerability database.
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.
Stored/reflected cross-site scripting in WC Fields Factory 4.1.12 and earlier allows authenticated subscriber-level attackers to inject script that executes when a higher-privileged user views the affected field content. The plugin is a WooCommerce add-on for WordPress, and successful exploitation can lead to session theft, administrative actions performed in the victim's browser, or content manipulation, though the requirement for a subscriber account and victim interaction substantially narrows practical risk. CVSS 6.5; no public exploit identified at time of analysis, and no CISA KEV status is reported.
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Unauthenticated information disclosure in the Slider Pro WordPress plugin (versions 0 through 1.0.0) allows any remote visitor to call an AJAX action that performs no capability or authorisation check, returning the titles, excerpts, permalinks and media metadata of non-public posts such as drafts, pending, scheduled, private and trashed items, plus post revisions. The exposure is confined to metadata rather than full post bodies, which keeps the confidentiality impact limited (CVSS 3.1 base 5.3, Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect. Publicly available exploit code exists, but CISA's SSVC assessment records no active exploitation and no KEV listing applies.
On any WordPress site running the File Media Renamer plugin through version 1.3, an authenticated low-privilege user who holds file-upload capability - typically an Author, or a Contributor explicitly granted uploads - can rename media attachments that belong to other users, including administrators, because the plugin never checks whether the requester is authorised to modify the targeted attachment. Beyond the direct rename, the operation rewrites the stored file path while leaving other site data (post content and plugin metadata that referenced the original path) pointing at the old filename, producing broken images and corrupted references that persist until manually repaired. Publicly available exploit code exists, and while there is no confirmed active exploitation (no CISA KEV entry), the flaw is trivially reachable by anyone who can already upload files, with no victim interaction required. Independent assessment characterises this as a broken-access-control / IDOR problem rather than an authentication bypass: the attacker must already hold a valid account, so it is an insider or multi-author-site threat, not a remote-unauthenticated one.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Unauthenticated attackers can forge payment-notification callbacks to the elegro Crypto Payment WordPress plugin (versions through 1.0.1) and arbitrarily change the status of orders on any installation where the shared secret has been left at its default empty value. No credentials, user interaction, or special network position are required against a vulnerable default-config site, and publicly available exploit code exists; however, the attack is fully neutralized once an administrator sets a non-empty shared secret, so only sites that never completed that configuration step are exposed. The independently assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity of order/payment state, with no confidentiality or availability effect, making this a moderate, conditional risk.
Unauthenticated attackers can manipulate order states in the Deema Payment Gateway WordPress plugin (versions through 1.1.2) by exploiting a missing payment verification step in the hosted-checkout return handler, causing orders to be marked as paid without any actual payment. The plugin fails to confirm transaction status or amount with the payment provider, and publicly available exploit code exists. With a CVSS score of 5.3 (MEDIUM), the impact is limited to integrity of order data, with no confidentiality or availability effects.
Unauthenticated attackers can mark unpaid orders as paid or cancel/refund existing orders on WordPress sites running the Deema Payment Gateway plugin through version 1.1.2, because the plugin fails to verify the authenticity of incoming payment provider notifications and ships with that verification disabled by default. The flaw is remotely exploitable without authentication (CVSS 5.3, CWE-287) and affects order integrity only, with no server compromise or data disclosure. Publicly available exploit code exists, but CISA SSVC indicates no observed exploitation; this is a genuine but moderate-priority issue rather than a critical emergency, and it should be patched or mitigated promptly.
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization checks in the WordPress plugin WDS MCP Content Manager (versions up to and including 3.10.4) let an authenticated Contributor-level user invoke functionality that should be reserved for higher-privileged roles, enabling limited unauthorized modification of plugin-managed content and settings. Exploitation requires only a Contributor account - a role that is trivially obtained on multi-author blogs and sites with open registration - needs no user interaction, and is reachable over the network, but the resulting impact is confined to a low-integrity change with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the 'Authentication Bypass' tag is somewhat overstated: this is an authenticated privilege/authorization gap, making it a low-to-moderate priority issue rather than a critical one.
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.
Missing authorization in the WordPress plugin WC Ukraine Shipping (wc-ukr-shipping) through version 1.23.2 lets an authenticated low-privilege user invoke plugin functionality that performs no capability check, allowing unauthorized modification of shipping configuration and related store data. The attack is network-reachable and requires no victim interaction, but it does require a valid session on the target site (PR:L) - a modest barrier that is often trivial to clear on WooCommerce stores that allow open customer registration, and the assessed impact is integrity-only with no confidentiality or availability effect. This is a moderate-risk, not top-priority, vulnerability: no public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote attackers can manipulate the quantity input handled by VillaTheme's BuildKit - Product Builder for WooCommerce - Custom PC Builder (all versions through 1.0.28), altering builder-supplied configuration data on affected stores. The defect is an improper-validation-of-specified-quantity flaw (CWE-1284): the plugin accepts a caller-supplied quantity without adequately checking its type, bounds, or consistency, so a crafted request can subvert the value the builder relies on. Impact is confined to integrity per the assessed vector (CVSS 5.3, I:L with C:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the narrow deployment base of this niche PC-builder plugin further limits real-world exposure.
Authorization bypass in CozyThemes Cozy Blocks WordPress plugin versions up to 2.2.23 allows unauthenticated remote attackers to access data they are not authorized to view via an insecure direct object reference (IDOR). The flaw, rated CVSS 4.0 6.9 by Patchstack, requires no authentication or user interaction and results in low confidentiality impact only. No public exploit code has been identified at time of analysis.
Authorization bypass in Themeisle's AI Chatbot for WordPress - Hyve Lite plugin (versions through 2.0.2) allows unauthenticated remote attackers to modify chatbot-related records they do not own by supplying a user-controlled object identifier, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This is a moderate-severity IDOR (CWE-639) tracked as CVE-2026-97305 and scored CVSS 4.0 6.9; exploitation is limited to a Low integrity impact, with no confidentiality or availability effect, and no public exploit was identified at time of analysis.
Missing authorization in the Arraytics Timetics WordPress plugin (versions through 1.0.63) lets remote attackers trigger plugin actions that lack proper access-control checks, allowing limited integrity and availability impact on affected sites (CVSS 6.5, CWE-862). The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms exploitation is unauthenticated and requires no victim interaction, though the impact is bounded - no confidentiality loss - and any WordPress installation running the vulnerable plugin with the affected endpoint reachable is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Patchstack, and the affected range ends at 1.0.63.
Improper access control in the WP User Manager plugin for WordPress, affecting all versions through 2.9.20, allows remote attackers to reach user-management operations they are not authorized to perform, resulting in privilege abuse (CVSS 6.5, CWE-284). The published vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates unauthenticated, remote reachability with low confidentiality and integrity impact, although the Patchstack classification of this as a privilege-escalation issue suggests a pre-existing low-privileged WordPress account may be the practical prerequisite; that prerequisite should be confirmed against the vendor advisory. There is no indication of confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis; patch status is not established in the available data, so sites running the plugin should treat 2.9.20 and earlier as vulnerable pending a fixed release.
Missing authorization checks in the UsersWP WordPress plugin (all versions through 1.2.74) allow an authenticated low-privilege user to perform privileged actions that modify site data, with no user interaction required on the victim's part. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the barrier to exploitation is a valid low-privileged account - realistically a self-registered subscriber on sites that leave public registration open - after which the attacker gains a high-integrity impact without any data disclosure or denial of service. This is a moderate-risk broken access control (CWE-862) issue; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting (XSS) in the Webful Creations RepairBuddy WordPress plugin (computer-repair-shop) through version 4.1225 allows an authenticated attacker with low-level privileges to inject malicious JavaScript into fields such as repair tickets or customer records. The payload is stored and later executed when a privileged user views the affected page, potentially leading to session hijacking or unauthorized actions on behalf of the victim. Rated CVSS 6.5 (Medium), exploitation requires a valid account and victim interaction; no public exploit code has been identified at time of analysis.
Missing authorization checks (CWE-862) in the VillaTheme Lookzy / woo-lookbook WordPress plugin, versions up to and including 1.1.14, let remote unauthenticated attackers invoke plugin functionality that should be protected by access-control and capability checks. Affected sites are those running the plugin (typically alongside WooCommerce) on internet-reachable WordPress installations; per the assessed vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction. Impact is bounded to the plugin's own functionality (integrity and availability low, confidentiality none), and no public exploit code has been identified at time of analysis, so the practical risk is constrained by the narrow population of sites running this specific plugin.
Reflected cross-site scripting (XSS) in the Adsmonetizer WordPress plugin (adsensei-b30) through version 3.2.4 allows remote attackers to inject arbitrary script into a victim's browser by convincing them to click a crafted link. The attacker does not need authentication, but exploitation requires user interaction and the targeted site must have the vulnerable plugin installed and reachable. This is rated CVSS 7.1, and no public exploit has been identified at time of analysis; it is not listed as confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the GhozyLab Image Slider Widget WordPress plugin (versions through 1.1.130) lets an authenticated low-privilege user - a contributor or author able to submit content - inject script into slider fields that executes in the browser of any administrator or editor who later views the rendered slider. CVSS 3.1 rates this 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting mandatory authentication (PR:L), required victim interaction (UI:R), and scope change because the payload escapes the plugin's context into the broader WordPress page. No public exploit identified at time of analysis, and the plugin is not in CISA KEV.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
Unauthenticated remote attackers can tamper with limited plugin-controlled data in Kit (formerly ConvertKit) for WooCommerce versions up to 2.2.0 due to a missing authorization flaw, enabling unauthorized modification of certain settings or data. The vulnerability has a CVSS score of 5.3 with low integrity impact and does not require authentication or user interaction, though it cannot exfiltrate confidential data or cause denial of service. No public exploit identified at time of analysis, and patch availability is not confirmed.
Information disclosure in the WP SYNTEX Polylang WordPress plugin through 3.8.7 lets an authenticated low-privileged user bypass a missing authorization check (CWE-862) and retrieve embedded sensitive data they are not entitled to access. The issue carries a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): exploitation is network-reachable, low complexity and needs no user interaction, but requires a valid account with at least low privileges such as a default Subscriber, with no impact to integrity or availability. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), so exposure is materially higher on sites that permit open user registration or host many low-trust accounts than on sites with restricted account creation.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Missing authorization checks in the Fluent Forms Pro Add On Pack for WordPress, affecting versions up to and including 6.2.13, allow unauthenticated remote attackers to reach functionality that should require elevated permissions, yielding a low-integrity impact (vendor/NVD CVSS 3.1 base score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the vector is PR:N/UI:N, no login and no victim interaction are required; the practical exposure is limited to incorrect modification of plugin-controlled data, with no confidentiality or availability impact assessed. Only sites that have purchased and activated this paid add-on are affected - installations running the free Fluent Forms base plugin alone are not vulnerable. At time of analysis there is no CISA KEV entry and no public exploit identified, and no EPSS score was supplied.
Missing authorization checks in the WordPress plugin WP Dummy Content Generator (all versions through 4.0.0) let an authenticated low-privilege user - a subscriber or contributor, per the CVSS vector's PR:L - invoke plugin functionality that should be reserved for higher-privileged roles, producing a limited integrity impact (CVSS 3.1 score of 4.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, CWE-862). Exploitation requires the plugin to be installed and active and the attacker to hold valid credentials for a registrable low-privilege account, with no user interaction needed, and the effect is confined to modification of content the plugin manages rather than disclosure or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was supplied in the source data, so the residual risk is low-to-moderate and is highest on sites that permit open self-registration.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Unsafe reflection (CWE-470) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin through version 2.0.22 lets a low-privileged authenticated account steer which class or code the plugin loads, exposing information that account should not be able to read. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) confirms the attacker must hold a valid WordPress login with at least low privileges, that no user interaction is required, and that impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, so this is a moderate-severity authenticated information-disclosure issue rather than an emergency, though it is worth remediating because the authentication bar is low on multi-author and membership sites.
Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. There is no CISA KEV entry and no public exploit identified at time of analysis, so real-world priority is low-to-moderate; no EPSS score was supplied with the available intelligence.
Unauthenticated information disclosure in the Blubrry PowerPress Podcasting WordPress plugin (versions up to and including 11.17.9) let's remote attackers retrieve embedded sensitive data from an affected site because a function handling that data lacks a proper authorization check (CWE-862). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are required, but the impact is confined to confidentiality only, limited to specific embedded data rather than arbitrary site data, credentials, or any write capability. No confirmed active exploitation (CISA KEV) or publicly available exploit code has been identified at time of analysis, making this a genuine but low-to-moderate priority issue rather than an emergency; the exact vulnerable route is not specified in the source advisory, which constrains precise detection.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Authenticated low-privilege users can read and modify support tickets they do not own in the JS Help Desk WordPress plugin (Ahmad) through version 4.0.0, due to an insecure direct object reference (CWE-639) that exposes user-controlled ticket identifiers. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires a valid low-privilege account and is limited to confidentiality and integrity impact on support-ticket data, with no availability impact. No public exploit identified at time of analysis; no exploit code or KEV listing is referenced in the available intelligence.
Stored cross-site scripting in the WordPress plugin Name Directory (versions through 1.34.2) lets an authenticated attacker with low privileges (PR:L) save a script payload into directory content that executes in the browser of any user who later views the affected page (UI:R). Because the injected content persists, a single submission can fire for administrators or visitors on every subsequent page load, though the attacker must already hold an account able to author or edit Name Directory entries and the payload remains inert until someone else opens the page; per the CVSS vector PR:N is absent, so this is an authenticated-context issue rather than an unauthenticated one. The independent assessment rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with impact confined to browser-context script execution and no public exploit identified at time of analysis.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Missing authorization checks in the WordPress Event Tickets plugin from Liquid Web / StellarWP (versions through 5.30.0) allow an authenticated low-privilege user to carry out restricted ticket-related actions they should not be permitted to perform, resulting in limited integrity impact with no data disclosure or denial of service. As confirmed by the CVSS vector (PR:L), exploitation requires a valid account on the target site at a low privilege level - typically a self-registered subscriber, customer, or event attendee - so sites that allow open user registration carry more exposure than those with registration closed. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the assessed severity is low (CVSS 4.3), making this a genuine-but-low-priority hardening item rather than an emergency patch.
Stored cross-site scripting (XSS) in the LeapWorx Premium Addons for Elementor WordPress plugin, affecting versions through 4.11.109, allows an authenticated low-privileged user (contributor/author level, PR:L) to persist malicious script into plugin-handled content that executes in the browser of a higher-privileged victim who later views it (UI:R). Successful exploitation can lead to session theft, credential harvesting, or administrative actions performed in the victim's context, though it requires valid account access and victim interaction rather than being a zero-click or unauthenticated attack. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); EPSS data was not available for this CVE. The reported CVSS 3.1 base score is 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.
Missing authorization in the WordPress Name Directory plugin (through version 1.34.2) lets remote, unauthenticated attackers reach functionality and directory data that should require higher privileges or proper access-control checks. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects low-complexity, unauthenticated exploitation against default installs, with impact confined to low confidentiality loss and no integrity or availability effect, so the realistic outcome is unauthorized disclosure of directory entries rather than site takeover. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the primary practical exposure is limited to sites running the vulnerable plugin.
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.
Stored cross-site scripting in the Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (all versions through 5.14.2) lets an authenticated low-privilege user persist malicious script content that executes in the browser of any user who later views the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (vendor score 6.5), meaning exploitation requires a valid account on the target WordPress site plus a victim who loads the rendered content, so real-world risk is concentrated on sites that grant accounts to untrusted or self-registered users. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available data.
Stored cross-site scripting in impleCode's eCommerce Product Catalog plugin for WordPress (versions through 3.6.2) allows an authenticated user holding only low-level privileges to plant malicious JavaScript in catalog content, which then executes in the browser of any user - typically an administrator - who views the affected catalog page. The issue is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the available intelligence shows no public exploit identified at time of analysis and no vendor-released patch version confirmed in the provided data. Real-world risk is constrained because the attacker needs some authenticated role on the target site and must wait for a victim to load the poisoned page, and the plugin has to be installed and active - it is a niche e-commerce plugin rather than a default WordPress component.