WordPress
Monthly
Information disclosure in the WordPress plugin Video Conferencing with Zoom (video-conferencing-with-zoom-api, all versions through 4.6.10) allows any authenticated low-privilege account to retrieve sensitive data that the plugin embeds in the responses it sends to users. Both the CVSS 4.0 vector and the independently assessed CVSS 3.1 vector require a valid account (PR:L) with no user interaction (UI:N) and no administrative access, so exposure is greatest on sites that permit public or subscriber-level registration. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, giving a CVSS 4.0 base score of 5.3 that places this in moderate-severity, real-but-limited confidentiality risk rather than urgent-emergency territory.
WP Mailster, a WordPress newsletter and mailing-list plugin, contains a missing authorization flaw (CWE-862) affecting all versions through 1.9.0.0, allowing remote attackers to reach plugin functionality or data that should be gated behind an access-control check. According to the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), exploitation requires no authentication and no user interaction against a default installation, but the resulting impact is limited to low-level confidentiality loss - unauthorized read access to data or functionality rather than modification, deletion, or site takeover. No public exploit code and no confirmed active exploitation were identified in the provided intelligence at time of analysis, and the flaw was reported through Patchstack as a broken access control issue in the WordPress plugin ecosystem.
Incorrect currency-calculation logic in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, present in every release up to and including 2.2.17, allows remote attackers to trigger a bounded security impact against an affected site - the supplied vector requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). At CVSS 5.3 this is a moderate-severity, low-priority issue rather than an urgent threat: only a single low-severity outcome is realistic, with the public scoring signals disagreeing on whether that outcome is limited data disclosure (our assessed vector C:L/I:N) or limited data manipulation (the CNA vector I:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the only public record is a Patchstack advisory entry, so exploitation in the field has not been observed.
Missing authorization checks in the WordPress plugin WP Admin Audit (Brandtoss) through version 1.2.17 let an already-authenticated low-privilege user reach plugin functionality and audit data they are not permitted to see. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) the attacker must hold a valid account on the target site, so the flaw is not anonymously exploitable, and the impact is limited to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; severity is moderate (vendor-reported 4.3), with the main risk being disclosure of audit-log information to subscribers or other low-privilege accounts.
Authenticated low-privileged users can read support tickets belonging to other users in the Ahmad JS Help Desk WordPress plugin through version 4.0.0 by manipulating user-controlled object references. This is a classic insecure direct object reference (IDOR, CWE-639) limited to confidentiality impact; authentication is required per the CVSS vector (PR:L), and no public exploit code has been identified at time of analysis. With a CVSS score of 4.3 and no active exploitation reported, this is a moderate-severity, low-priority issue.
Missing authorization in the WP VR WordPress plugin (WPFunnels Team) allows an authenticated low-privileged user to invoke privileged plugin functionality that should be restricted, affecting every version through 9.1.3. Exploitation requires a valid account on the target site (CVSS PR:L) plus a user-interaction step (UI:R), and the resulting impact is limited to low confidentiality, integrity, and availability loss under a changed scope, for a base score of 6.5. No public exploit identified at time of analysis, no CISA KEV listing, and the supplied intelligence does not name a fixed plugin version.
QR Redirector WordPress plugin through 2.0.5 allows an authenticated low-privilege user to store malicious input via its redirect-entry functionality, which then executes in the browser of a higher-privileged victim who views the affected page. This is a moderate-severity stored cross-site scripting issue tracked as CVE-2026-105069 (CVSS 6.5, CWE-79); exploitation requires an authenticated account and victim interaction, and no public exploit identified at time of analysis.
Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in the Pixelite Events Manager WordPress plugin through version 7.4.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from outbound responses. No public exploit code has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only impact rated Low. This is a moderate, low-priority vulnerability rather than a critical threat.
WordPress sites running the Memberful - Membership Plugin (memberful-wp) through version 1.81.2 can expose sensitive system information to any authenticated user holding a low-privilege account, such as a subscriber or registered member. The flaw is reachable over the network with low attack complexity and requires no user interaction, but the impact is confidentiality-only and limited in scope (CVSS 4.3, C:L), making this a low-to-moderate priority hardening item rather than an emergency patch. No public exploit code was identified at time of analysis, and the vulnerability is not known to be actively exploited.
Stored cross-site scripting in the bPlugins B Blocks WordPress plugin (all versions through 2.1.8) lets an authenticated user with posting privileges inject persistent JavaScript that executes in the browser of any privileged user who subsequently views the crafted block content. Rated CVSS 6.5 (medium), exploitation requires a low-privileged WordPress account and victim interaction, but it can lead to session theft, defacement, or administrative actions performed under the victim's identity. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Unauthenticated attackers can mark arbitrary orders as paid in the UPI QR Code Payment Gateway WordPress plugin through version 1.4.3, because the plugin's payment-confirmation handler does not verify that the confirmation request belongs to the order and customer it references (CWE-639, authorization bypass through a user-controlled key). The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), but the impact is limited to falsifying payment status with no data disclosure or denial of service, and exploitation requires the plugin to be installed and enabled as an active checkout payment method plus attacker knowledge or enumeration of a valid order ID. No public exploit code or CISA KEV entry was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one, consistent with the independent assessment.
Unauthenticated disclosure of other customers' uploaded files is possible through the File Uploads Addon for WooCommerce WordPress plugin in versions 1.7.2 through 1.7.5, because the plugin serves stored uploads without verifying that the requester is the customer who originally uploaded the file (CWE-639). An attacker who knows or guesses the exact file name of a previously uploaded file can retrieve it over the network with no account and no user interaction, as reflected by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9 Medium) - the High attack complexity stems entirely from the file-name discovery prerequisite, so real-world difficulty hinges on whether the plugin generates guessable or sequential names versus long random tokens. There is no public exploit identified at time of analysis, and the vendor has released a fix in 1.7.6.
Unauthenticated retrieval of customer-uploaded files is possible in the File Uploads Addon for WooCommerce WordPress plugin (versions 1.7.2 through 1.7.6), which stores customer submissions in a publicly web-accessible uploads directory while the access restriction it generates fails to actually block direct requests; an attacker who knows or can guess a file's name can fetch it straight from the web root, bypassing the plugin's authenticated download mechanism. The issue is a broken access control / insecure direct object reference problem (CWE-284) rather than a true authentication bypass, and only confidentiality of already-uploaded files is affected - no integrity or availability impact. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), the attack is unauthenticated and needs no user interaction, but the High attack-complexity component reflects that the attacker must correctly guess or otherwise learn the target filename; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Sensitive information embedded in outbound responses from the Mindio Magic MCP WordPress plugin (versions through 0.5.6) can be retrieved by a remote, authenticated attacker holding only low-level privileges on the affected site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The flaw is a CWE-201 'Insertion of Sensitive Information Into Sent Data' condition, meaning the plugin places data into responses it transmits rather than leaking it through a separate storage or traversal bug. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low-to-moderate. The CVSS base score of 4.3 reflects that an attacker must already possess a valid WordPress account on the target site before the disclosure is reachable.
Unauthenticated retrieval of other users' stored private files is possible on WordPress multisite installations running the User Private Files plugin before 2.2.0. On multisite, the plugin's rewrite rule - the mechanism that routes file requests through its access check - is never reached, so private files can be fetched directly over HTTP with no credentials, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists, but EPSS is only about 0.14% (3rd percentile) and a vendor fix is available in 2.2.0; impact is confined to confidentiality, with no write or code-execution capability.
Authenticated WordPress users holding Author-level access or above can abuse the schema field default-value resolution feature in the Five Star Business Profile and Schema plugin (versions prior to 2.4.0, including 2.3.20 through 2.3.x) to pull sensitive server-side data into publicly rendered schema output, including other users' password hashes and arbitrary wp_options values, which unauthenticated visitors can then read. Publicly available exploit code exists, but CISA KEV does not list this issue and EPSS is only 0.14% (3rd percentile), so real-world exploitation pressure is low. This is a moderate, not high-urgency, issue: exploitation requires an existing Author or higher account, so sites that never grant that role to untrusted users are not practically exposed, though the vector is network-reachable (CVSS 4.9; CWE-200).
Stored cross-site scripting in the Simple Shopping Cart WordPress plugin (versions before 5.2.6) allows an authenticated administrator to save malicious markup into plugin settings fields that are output without escaping on the plugin's admin settings page, where the script executes in the browser of an administrator who subsequently loads that page. The issue is most meaningful on WordPress multisite installations, where site administrators do not hold the unfiltered_html capability and would otherwise have their script-bearing input stripped, whereas on single-site installs where administrators already possess unfiltered_html the practical gain is negligible. Publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation; the vendor-released fix is version 5.2.6.
Arbitrary modification of shipping information on WooCommerce orders is possible in the Razorpay for WooCommerce plugin before 4.8.8, allowing unauthenticated attackers to alter shipping details on orders they do not own. The flaw is a missing authorization check (CWE-639) on a REST API route used during checkout; publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile), indicating low predicted exploitation likelihood, and the vendor has released a patch in version 4.8.8.
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Reflected cross-site scripting in the WPFront Notification Bar WordPress plugin (versions up to and including 3.5.1) lets an unauthenticated remote attacker inject arbitrary JavaScript into a victim's browser by reflecting the raw request URI into an inline script block emitted on wp_footer. The attack requires the plugin's non-default debug logging option (write_debug_logs) to be enabled, and it only fires when a victim follows a specially crafted link, so practical exposure is limited to sites that have turned on debug logging; the impact is client-side only, with low confidentiality and integrity effects and no server-side code execution. Wordfence is the reporting source, no public exploit code was identified at time of analysis, and there is no CISA KEV listing; the upstream repository shows a changeset (3722432) addressing the code path, though a tagged patched release is not independently confirmed. Note also that the plugin's own score of 6.1 with AC:L assumes a default configuration, whereas our assessment raises attack complexity (AC:H) because exploitation is gated by the non-default debug-logging setting.
Reflected cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin, versions up to and including 1.8.46, lets unauthenticated attackers inject arbitrary JavaScript through the unsanitized 'thumb_url' parameter handled by the editimage_bwg AJAX action. Because that handler performs a capability check but no nonce verification, a payload can be delivered in a plain crafted GET request without any CSRF token, and it executes in the browser of a logged-in WordPress administrator; there is no public exploit identified at time of analysis. The realistic impact is moderate rather than critical: successful exploitation requires the victim to hold the manage_options capability and to be socially engineered into clicking an attacker-supplied link, so this is a genuine but moderate-priority issue, not a top-tier emergency.
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.
Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Unauthenticated information disclosure in the Pie Register WordPress plugin (versions before 3.8.4.14) lets any remote visitor who knows a valid invitation code retrieve the usernames and email addresses of every user who registered with that code. The flaw is an access-control gap in the plugin's invitation-code report, which lacks a capability or ownership check before returning registration data (CWE-200). Exploitation is constrained by the requirement to already know a valid invitation code - the reason CVSS assigns AC:H and a low base score of 3.7 - and although publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV) and EPSS is only 0.14% (3rd percentile).
Stored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with the plugin's translator capability or higher to inject unsanitized bundle configuration values that are later rendered in an admin page, executing script in the browser of a high-privilege user such as an administrator who views that page. The vulnerability is tracked as CVE-2026-94239 and publicly available exploit code exists, though EPSS is low at 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation. Real-world risk is moderate because exploitation requires a delegated translator-level account and a privileged victim to load the poisoned admin page, making it a second-tier priority rather than an emergency.
Path traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's translator capability read certain file types from arbitrary server paths, including outside the web root. Publicly available exploit code exists, but CISA KEV does not list active exploitation; EPSS is 0.16% (4th percentile) and SSVC rates exploitation as none, making this a real-but-not-urgent issue. Because the attacker must already have the translator capability (PR:H), anonymous and default low-privileged visitors cannot trigger it.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
Authenticated arbitrary file read in the MPG WordPress plugin (versions before 4.2.3) allows a user holding the Editor role or higher to supply a local filesystem path in the project import 'dataset source' field, which the plugin copies into the public uploads directory where any unauthenticated visitor can then retrieve it. The issue is a path traversal (CWE-22) rated CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and publicly available exploit code exists; EPSS is low at 0.16% (5th percentile) and there is no CISA KEV listing for this CVE. Because exploitation requires a privileged account, the practical impact is a high-privilege arbitrary file read whose severity depends on what files the web server process can read, rather than a remote-unauthenticated compromise.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin (widgetpack) affects all versions up to and including 7.1.3 and lets injected JavaScript run for every visitor of any page that renders imported Google reviews. Two delivery paths are confirmed by the available data: a WordPress user with subscriber-level access or above can inject script through the 'reviews[].text' parameter, and - because the plugin's default daily cron auto-imports review content from the connected Google business profile - an unauthenticated attacker can plant the payload by posting a crafted Google review on that business, with no WordPress credentials required; our independent assessment scores this path CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (the vendor's 6.4 uses PR:L for the authenticated path). Once stored, the payload executes on DOMContentLoaded without further user interaction, though exploitation is gated by the daily import cycle, an enabled auto-import feature, an active Google Business connection, and display of the affected review block; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Reflected cross-site scripting in the EWWW Image Optimizer plugin for WordPress (all versions up to and including 8.7.7) lets unauthenticated remote attackers inject arbitrary script into a page by supplying a crafted REQUEST_URI parameter key that is reflected without adequate sanitization or escaping into the plugin's HelpScout Beacon script block. Per the CVSS vector (PR:N, UI:R, S:C), no attacker authentication is required, but a victim must be tricked into clicking a crafted link, and the injected script runs only in that victim's browser session - this is a reflected, not stored, issue. Two independent gating factors temper real-world priority: the plugin's enable_help option must be active (the vulnerable beacon block is emitted only when it is), and exploitation depends entirely on user interaction; reflected cross-site scripting is rated 6.1 and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Reflected cross-site scripting (XSS) in the Ivory Search - WordPress Search Plugin, affecting all versions up to and including 5.5.18, allows unauthenticated attackers to inject arbitrary web scripts via the 's' search parameter. However, exploitation requires three specific conditions: the non-default 'Highlight Search Terms' option must be enabled by an administrator, the malicious search query must return at least one post result, and a victim must be socially engineered into opening a crafted URL. These factors significantly limit realistic exploitation, and our assessment adjusts attack complexity to High despite the base CVSS score of 6.1 (Medium). No public exploit code is known at this time.
Time-based SQL injection in the SupportCandy - AI Customer Support Ticket System & Live Chatbot Agent WordPress plugin, affecting all versions up to and including 3.5.3, lets an authenticated attacker inject SQL through the unsanitized 'sort_by' parameter and use deliberate query delays to extract sensitive data from the site's database. Exploitation is gated by a non-default permission combination: the attacker must hold both a WordPress Subscriber-or-higher account and a SupportCandy Agent account explicitly granted the 'Assign Agents' capability, which confines the realistic threat to trusted-but-malicious or compromised agent accounts rather than anonymous visitors. Per CVSS 3.1 (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confidentiality-only, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Stored cross-site scripting in the SupportCandy WordPress plugin (all versions up to and including 3.5.3) lets an authenticated attacker holding only subscriber-level access plant arbitrary JavaScript via the 'name' parameter, which then executes in the browser of any administrator or support agent who later renders the affected admin or ticket page. Because the documented exploit chain depends on the 'Register user if not exists' option being disabled - the plugin's default state - most installations sit in the vulnerable configuration, though the attacker still needs a subscriber account and must wait for a privileged victim to view the injected content. Severity is moderate (CVSS 6.4, Medium) and consistent with a routine patch-management item; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.
Blind SQL injection in the Beaver Builder Page Builder plugin for WordPress (versions up to and including 2.11.0.5) allows authenticated attackers with Contributor-level access or higher to extract sensitive information from the database. Exploitation requires owning a draft post of a Beaver Builder post type to obtain the fl_ajax_update nonce, and the injection is blind, meaning data must be inferred rather than read directly; no public exploit was identified at time of analysis, and the issue is a genuine but moderate-priority risk rather than a top-tier emergency. The vulnerability is rated CVSS 6.5 with confidentiality impact only (no integrity or availability impact) and is limited to sites that grant untrusted users Contributor privileges.
Unauthenticated shortcode injection in the All in One SEO (AIOSEO) WordPress plugin before 5.0.2.1 lets remote attackers smuggle registered shortcodes past the plugin's shortcode-stripping routine and have them executed in content derived from user input; on sites upgraded from older plugin versions the stripping protection is disabled entirely, so no crafted payload is required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) reflects unauthenticated, no-interaction reachability with limited confidentiality and integrity impact rather than full compromise, and the practical severity depends on which shortcodes are registered on the target (from the plugin, theme, or other plugins). Publicly available exploit code exists and a vendor patch is available in 5.0.2.1; there is no evidence of confirmed active exploitation (no CISA KEV listing), so this is best treated as a moderate-priority, patched issue with a public PoC.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated remote attackers can win a timing race against the booking/availability logic in WPdevelop's Booking Calendar WordPress plugin through version 11.8.4, producing inconsistent or corrupted booking state (integrity-only, CVSS 3.1 score 3.7). The scored vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that no credentials or user interaction are required, but success is non-deterministic and normally demands many rapid parallel requests to the public booking submission flow, with no data disclosure or availability impact. This is a low-severity, low-real-world-priority issue: there is no CISA KEV listing and no public exploit identified at time of analysis.
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.
Airano MCP Bridge, a WordPress plugin, ships an MCP bridge action that performs privileged operations without validating the caller's capabilities, so any authenticated low-privilege user (for example a Subscriber) can invoke it and modify data that should be reserved for administrators. The flaw affects all versions up to and including 2.11.0, is remotely reachable over the network with low attack complexity and no user interaction, and is rated CVSS 3.1 base 6.5 with high integrity impact but no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is gated on the attacker already holding a valid account on the target site.
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
Authenticated server-side request forgery (SSRF) in ThemeREX Addons versions up to 2.46.0 allows any logged-in WordPress user with low privileges to force the server to make arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints. The CVSS 6.4 rating reflects limited confidentiality and integrity impact, and exploitation requires the plugin to be active and an attacker to hold a valid low-privilege account. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the ThemeREX Addons WordPress plugin, affecting all versions through 2.46.0, allows an authenticated attacker with at least low-level posting privileges to inject malicious JavaScript that executes in the browser of a privileged user who views the compromised page. The vulnerability has a CVSS 3.1 base score of 6.5 and requires victim interaction; no public exploit code or active exploitation has been identified at the time of analysis. Impact is limited to browser-context script execution and does not result in server-side compromise.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Embedded sensitive data exposure in the Monetizemore Advanced Ads WordPress plugin (versions through 2.0.26) allows an authenticated low-privilege user to retrieve sensitive data embedded in plugin-controlled objects by manipulating a user-controlled key or identifier. The flaw is a CWE-639 authorization bypass (IDOR-style) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is network-reachable but requires at least low-tier authenticated credentials and yields confidentiality-only impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the issue was reported through the Patchstack vulnerability disclosure program.
Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running the Shahjada Download Manager plugin versions up to 3.3.71 by exploiting an authorization bypass through a user-controlled key (CWE-639). The vulnerability allows access to data that should be restricted, though impact is limited to confidentiality (C:L) with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Stored cross-site scripting in the Download Manager plugin for WordPress (codename065, all versions up to and including 3.3.70) allows any authenticated user with subscriber-level access or above to persist arbitrary JavaScript through the profile Display Name field, which then executes in the browser of any user - including administrators - who views the affected page or the plugin's download statistics/history screens. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms the attacker must be authenticated (PR:L) but no victim interaction is required beyond rendering the injected content, and the scope change (S:C) reflects cross-privilege execution in the administrative context. Exploitation is strictly conditional: the site must expose the [wpdm_edit_profile] shortcode on a front-end page reachable by Subscriber-level accounts, which in practice usually means open self-registration is enabled; sites lacking that shortcode placement or with registration disabled are not exploitable through this path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied, so this should be treated as a moderate, conditionally exploitable issue rather than an urgent one.
Authenticated SQL injection in the Event Tickets and Registration WordPress plugin (all versions up to and including 5.29.5) allows a contributor-level user to append arbitrary SQL to the Tickets Commerce order-listing query through the unsanitized 'orderby' parameter, enabling extraction of sensitive data from the WordPress database. The exploit path is reachable by any account holding contributor privileges or above, because the can_access_page() check only verifies that the requester authored the supplied post_id rather than requiring the edit_others_posts capability, so a contributor who publishes their own post can reach the vulnerable code without elevated rights. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with a CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confined to confidentiality, meaning read-only access to database contents with no write or denial-of-service effect.
Stored cross-site scripting in the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress (all versions up to and including 6.1.1) allows an authenticated attacker to inject arbitrary JavaScript through the 'lsd[remark]' listing parameter, which is then persisted and executed in the browser of any user who later views the affected page. Because the listing-creation branch of the plugin's AJAX handler omits a capability check and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode, the practical prerequisite collapses to merely holding any account on the site - a Subscriber account suffices, making sites with open user registration (typical for directory and classifieds deployments) the primary exposure. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); the CVSS 3.1 score is 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Sensitive information exposure in the Otter Blocks WordPress plugin (all versions up to and including 3.2.6) allows any authenticated user with subscriber-level access or above to retrieve the email addresses and submission dates of the five most recent form submitters, along with the site's total form submission count, by manipulating the 'otter_form_widget_filter' parameter. The vulnerable widget is registered whenever the themeisle_blocks_form_emails option is non-empty - the normal state on any site that has saved a Form block - so the exposure is live on standard sites using the plugin's form feature. No public exploit identified at time of analysis, and no evidence of active exploitation; the exposed data set is small and fixed, and the independent assessment rates real-world risk as consistently low (low-severity information disclosure under CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Authenticated SQL injection in MultiVendorX (Dc WooCommerce Multi Vendor) 5.0.18 and earlier allows a vendor-level user holding the 'edit_stores' capability to inject arbitrary SQL through the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint, enabling extraction of sensitive data from the WordPress database. The flaw carries a CVSS 3.1 base score of 6.5 (network-reachable, low privileges required, high confidentiality impact, no integrity or availability impact) and there is no public exploit identified at time of analysis. Exposure is limited to sites running an affected version with the MarketplaceCompliance module active; sites that never use the report-abuse feature, or that have updated past 5.0.18, are not affected, and the realistic threat is a malicious or compromised vendor account rather than an unauthenticated internet-wide attacker.
Reflected cross-site scripting in the Greenshift - animation and page builder blocks WordPress plugin (all versions up to and including 13.2.0) allows an unauthenticated remote attacker to inject arbitrary script that is echoed unescaped inside a <script type="module"> tag when the '{{GET:...}}' dynamic placeholder is used in an element block's Custom JS field. Exploitation is conditional rather than universal: a site administrator must previously have configured a block's Custom JS to include a {{GET:...}} placeholder and that JavaScript must contain the token 'import', and the victim must then be tricked into visiting an attacker-crafted link (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; base 6.1 per the vendor CVE record). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the realistically exposed population is the subset of Greenshift ≤13.2.0 sites that use {{GET:}} placeholders in Custom JS containing 'import'.
The MStore API WordPress plugin (versions before 4.22.1) fails to restrict which order fields a customer may update, allowing any authenticated customer to mark their own unpaid order as paid or fulfilled and receive goods without paying; no admin rights or victim interaction are needed. Exploitation requires only a self-registerable customer account and an existing unpaid order belonging to the attacker, matching the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3) and bounding the impact to payment fraud rather than account takeover or data exposure. Publicly available exploit code exists according to WPScan, but there is no indication of confirmed active exploitation (the CVE is not in CISA KEV).
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). Exposure is greatest on builds below 2.0.18, where a Subscriber account - trivially obtainable on any site with open registration - is sufficient; from 2.0.18 through 2.0.20 the minimum role rises to Contributor or above. There is no CISA KEV entry, so confirmed active exploitation in the wild has not been established.
Unauthenticated attackers can manipulate gift-card amounts in WebToffee Gift Cards for WooCommerce before 1.3.1 to bypass configured denominations and reduce or eliminate order totals, obtaining products without full payment. Publicly available exploit code exists, and the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms remote, unauthenticated, no-user-interaction exploitation with low integrity impact only. The affected component requires WordPress with the vulnerable plugin and WooCommerce gift-card purchasing enabled; no server or data compromise is involved.
Price manipulation in the Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 lets remote attackers set an arbitrarily low purchase price by editing a client-supplied amount field that the plugin never recomputes on the server, so a buyer can pay far less than the merchant intended. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) and affects any site running the plugin at a version below 2.0.6 with an exposed checkout. Impact is limited to transaction integrity and direct financial loss to the merchant - no data confidentiality or availability impact - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV).
Information disclosure in the WordPress plugin Video Conferencing with Zoom (video-conferencing-with-zoom-api, all versions through 4.6.10) allows any authenticated low-privilege account to retrieve sensitive data that the plugin embeds in the responses it sends to users. Both the CVSS 4.0 vector and the independently assessed CVSS 3.1 vector require a valid account (PR:L) with no user interaction (UI:N) and no administrative access, so exposure is greatest on sites that permit public or subscriber-level registration. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, giving a CVSS 4.0 base score of 5.3 that places this in moderate-severity, real-but-limited confidentiality risk rather than urgent-emergency territory.
WP Mailster, a WordPress newsletter and mailing-list plugin, contains a missing authorization flaw (CWE-862) affecting all versions through 1.9.0.0, allowing remote attackers to reach plugin functionality or data that should be gated behind an access-control check. According to the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), exploitation requires no authentication and no user interaction against a default installation, but the resulting impact is limited to low-level confidentiality loss - unauthorized read access to data or functionality rather than modification, deletion, or site takeover. No public exploit code and no confirmed active exploitation were identified in the provided intelligence at time of analysis, and the flaw was reported through Patchstack as a broken access control issue in the WordPress plugin ecosystem.
Incorrect currency-calculation logic in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, present in every release up to and including 2.2.17, allows remote attackers to trigger a bounded security impact against an affected site - the supplied vector requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). At CVSS 5.3 this is a moderate-severity, low-priority issue rather than an urgent threat: only a single low-severity outcome is realistic, with the public scoring signals disagreeing on whether that outcome is limited data disclosure (our assessed vector C:L/I:N) or limited data manipulation (the CNA vector I:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the only public record is a Patchstack advisory entry, so exploitation in the field has not been observed.
Missing authorization checks in the WordPress plugin WP Admin Audit (Brandtoss) through version 1.2.17 let an already-authenticated low-privilege user reach plugin functionality and audit data they are not permitted to see. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) the attacker must hold a valid account on the target site, so the flaw is not anonymously exploitable, and the impact is limited to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; severity is moderate (vendor-reported 4.3), with the main risk being disclosure of audit-log information to subscribers or other low-privilege accounts.
Authenticated low-privileged users can read support tickets belonging to other users in the Ahmad JS Help Desk WordPress plugin through version 4.0.0 by manipulating user-controlled object references. This is a classic insecure direct object reference (IDOR, CWE-639) limited to confidentiality impact; authentication is required per the CVSS vector (PR:L), and no public exploit code has been identified at time of analysis. With a CVSS score of 4.3 and no active exploitation reported, this is a moderate-severity, low-priority issue.
Missing authorization in the WP VR WordPress plugin (WPFunnels Team) allows an authenticated low-privileged user to invoke privileged plugin functionality that should be restricted, affecting every version through 9.1.3. Exploitation requires a valid account on the target site (CVSS PR:L) plus a user-interaction step (UI:R), and the resulting impact is limited to low confidentiality, integrity, and availability loss under a changed scope, for a base score of 6.5. No public exploit identified at time of analysis, no CISA KEV listing, and the supplied intelligence does not name a fixed plugin version.
QR Redirector WordPress plugin through 2.0.5 allows an authenticated low-privilege user to store malicious input via its redirect-entry functionality, which then executes in the browser of a higher-privileged victim who views the affected page. This is a moderate-severity stored cross-site scripting issue tracked as CVE-2026-105069 (CVSS 6.5, CWE-79); exploitation requires an authenticated account and victim interaction, and no public exploit identified at time of analysis.
Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in the Pixelite Events Manager WordPress plugin through version 7.4.5 allows unauthenticated remote attackers to retrieve embedded sensitive data from outbound responses. No public exploit code has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a confidentiality-only impact rated Low. This is a moderate, low-priority vulnerability rather than a critical threat.
WordPress sites running the Memberful - Membership Plugin (memberful-wp) through version 1.81.2 can expose sensitive system information to any authenticated user holding a low-privilege account, such as a subscriber or registered member. The flaw is reachable over the network with low attack complexity and requires no user interaction, but the impact is confidentiality-only and limited in scope (CVSS 4.3, C:L), making this a low-to-moderate priority hardening item rather than an emergency patch. No public exploit code was identified at time of analysis, and the vulnerability is not known to be actively exploited.
Stored cross-site scripting in the bPlugins B Blocks WordPress plugin (all versions through 2.1.8) lets an authenticated user with posting privileges inject persistent JavaScript that executes in the browser of any privileged user who subsequently views the crafted block content. Rated CVSS 6.5 (medium), exploitation requires a low-privileged WordPress account and victim interaction, but it can lead to session theft, defacement, or administrative actions performed under the victim's identity. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Unauthenticated attackers can mark arbitrary orders as paid in the UPI QR Code Payment Gateway WordPress plugin through version 1.4.3, because the plugin's payment-confirmation handler does not verify that the confirmation request belongs to the order and customer it references (CWE-639, authorization bypass through a user-controlled key). The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), but the impact is limited to falsifying payment status with no data disclosure or denial of service, and exploitation requires the plugin to be installed and enabled as an active checkout payment method plus attacker knowledge or enumeration of a valid order ID. No public exploit code or CISA KEV entry was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one, consistent with the independent assessment.
Unauthenticated disclosure of other customers' uploaded files is possible through the File Uploads Addon for WooCommerce WordPress plugin in versions 1.7.2 through 1.7.5, because the plugin serves stored uploads without verifying that the requester is the customer who originally uploaded the file (CWE-639). An attacker who knows or guesses the exact file name of a previously uploaded file can retrieve it over the network with no account and no user interaction, as reflected by CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9 Medium) - the High attack complexity stems entirely from the file-name discovery prerequisite, so real-world difficulty hinges on whether the plugin generates guessable or sequential names versus long random tokens. There is no public exploit identified at time of analysis, and the vendor has released a fix in 1.7.6.
Unauthenticated retrieval of customer-uploaded files is possible in the File Uploads Addon for WooCommerce WordPress plugin (versions 1.7.2 through 1.7.6), which stores customer submissions in a publicly web-accessible uploads directory while the access restriction it generates fails to actually block direct requests; an attacker who knows or can guess a file's name can fetch it straight from the web root, bypassing the plugin's authenticated download mechanism. The issue is a broken access control / insecure direct object reference problem (CWE-284) rather than a true authentication bypass, and only confidentiality of already-uploaded files is affected - no integrity or availability impact. Rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), the attack is unauthenticated and needs no user interaction, but the High attack-complexity component reflects that the attacker must correctly guess or otherwise learn the target filename; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV).
Sensitive information embedded in outbound responses from the Mindio Magic MCP WordPress plugin (versions through 0.5.6) can be retrieved by a remote, authenticated attacker holding only low-level privileges on the affected site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The flaw is a CWE-201 'Insertion of Sensitive Information Into Sent Data' condition, meaning the plugin places data into responses it transmits rather than leaking it through a separate storage or traversal bug. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low-to-moderate. The CVSS base score of 4.3 reflects that an attacker must already possess a valid WordPress account on the target site before the disclosure is reachable.
Unauthenticated retrieval of other users' stored private files is possible on WordPress multisite installations running the User Private Files plugin before 2.2.0. On multisite, the plugin's rewrite rule - the mechanism that routes file requests through its access check - is never reached, so private files can be fetched directly over HTTP with no credentials, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists, but EPSS is only about 0.14% (3rd percentile) and a vendor fix is available in 2.2.0; impact is confined to confidentiality, with no write or code-execution capability.
Authenticated WordPress users holding Author-level access or above can abuse the schema field default-value resolution feature in the Five Star Business Profile and Schema plugin (versions prior to 2.4.0, including 2.3.20 through 2.3.x) to pull sensitive server-side data into publicly rendered schema output, including other users' password hashes and arbitrary wp_options values, which unauthenticated visitors can then read. Publicly available exploit code exists, but CISA KEV does not list this issue and EPSS is only 0.14% (3rd percentile), so real-world exploitation pressure is low. This is a moderate, not high-urgency, issue: exploitation requires an existing Author or higher account, so sites that never grant that role to untrusted users are not practically exposed, though the vector is network-reachable (CVSS 4.9; CWE-200).
Stored cross-site scripting in the Simple Shopping Cart WordPress plugin (versions before 5.2.6) allows an authenticated administrator to save malicious markup into plugin settings fields that are output without escaping on the plugin's admin settings page, where the script executes in the browser of an administrator who subsequently loads that page. The issue is most meaningful on WordPress multisite installations, where site administrators do not hold the unfiltered_html capability and would otherwise have their script-bearing input stripped, whereas on single-site installs where administrators already possess unfiltered_html the practical gain is negligible. Publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation; the vendor-released fix is version 5.2.6.
Arbitrary modification of shipping information on WooCommerce orders is possible in the Razorpay for WooCommerce plugin before 4.8.8, allowing unauthenticated attackers to alter shipping details on orders they do not own. The flaw is a missing authorization check (CWE-639) on a REST API route used during checkout; publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile), indicating low predicted exploitation likelihood, and the vendor has released a patch in version 4.8.8.
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.
Unauthenticated remote attackers can execute arbitrary registered WordPress shortcodes through the WP Ultimate Review plugin (versions up to and including 2.4.3), because the plugin passes an unvalidated value to do_shortcode and the only nonce gate is emitted to anonymous visitors via the public review form, while submitted reviews auto-publish without administrator approval by default. The CVSS 3.1 base score is 6.5 (Medium) with low confidentiality and integrity impact and no availability impact; the real-world severity depends on which shortcodes exist on the target site. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Reflected cross-site scripting (CWE-79) in the WPC Estimated Delivery Date for WooCommerce plugin, affecting all versions up to and including 4.0.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'rule_data' parameter, which execute in a victim's browser if they are tricked into clicking a crafted link. The vulnerability arises from insufficient input sanitization and output escaping, and although no public exploit code is identified at time of analysis, the CVSS 3.1 base score is 6.1 (Medium) with a user-interaction requirement (UI:R). The primary limiting factor is the need to persuade a victim to perform an action; the scope is changed (S:C) because the script runs in the context of the victim's session.
Arbitrary shortcode execution in the WP Ultimate Review WordPress plugin through version 2.4.3 lets any authenticated user with subscriber-level access or higher inject shortcodes that are stored and later executed when review content is rendered. The bypass abuses WordPress core behavior: the plugin passes attacker-controlled data into do_shortcode without validation, and the [[tag]] double-bracket escape is unwrapped to a bare [tag] by strip_shortcodes(), surviving wp_insert_post storage and firing through the_content on the publicly queryable xs_review post type. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires a low-privilege account, which makes it practically significant on sites with open user registration.
Reflected cross-site scripting in the WPFront Notification Bar WordPress plugin (versions up to and including 3.5.1) lets an unauthenticated remote attacker inject arbitrary JavaScript into a victim's browser by reflecting the raw request URI into an inline script block emitted on wp_footer. The attack requires the plugin's non-default debug logging option (write_debug_logs) to be enabled, and it only fires when a victim follows a specially crafted link, so practical exposure is limited to sites that have turned on debug logging; the impact is client-side only, with low confidentiality and integrity effects and no server-side code execution. Wordfence is the reporting source, no public exploit code was identified at time of analysis, and there is no CISA KEV listing; the upstream repository shows a changeset (3722432) addressing the code path, though a tagged patched release is not independently confirmed. Note also that the plugin's own score of 6.1 with AC:L assumes a default configuration, whereas our assessment raises attack complexity (AC:H) because exploitation is gated by the non-default debug-logging setting.
Reflected cross-site scripting in the Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin, versions up to and including 1.8.46, lets unauthenticated attackers inject arbitrary JavaScript through the unsanitized 'thumb_url' parameter handled by the editimage_bwg AJAX action. Because that handler performs a capability check but no nonce verification, a payload can be delivered in a plain crafted GET request without any CSRF token, and it executes in the browser of a logged-in WordPress administrator; there is no public exploit identified at time of analysis. The realistic impact is moderate rather than critical: successful exploitation requires the victim to hold the manage_options capability and to be socially engineered into clicking an attacker-supplied link, so this is a genuine but moderate-priority issue, not a top-tier emergency.
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.
Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Unauthenticated information disclosure in the Pie Register WordPress plugin (versions before 3.8.4.14) lets any remote visitor who knows a valid invitation code retrieve the usernames and email addresses of every user who registered with that code. The flaw is an access-control gap in the plugin's invitation-code report, which lacks a capability or ownership check before returning registration data (CWE-200). Exploitation is constrained by the requirement to already know a valid invitation code - the reason CVSS assigns AC:H and a low base score of 3.7 - and although publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV) and EPSS is only 0.14% (3rd percentile).
Stored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with the plugin's translator capability or higher to inject unsanitized bundle configuration values that are later rendered in an admin page, executing script in the browser of a high-privilege user such as an administrator who views that page. The vulnerability is tracked as CVE-2026-94239 and publicly available exploit code exists, though EPSS is low at 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation. Real-world risk is moderate because exploitation requires a delegated translator-level account and a privileged victim to load the poisoned admin page, making it a second-tier priority rather than an emergency.
Path traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's translator capability read certain file types from arbitrary server paths, including outside the web root. Publicly available exploit code exists, but CISA KEV does not list active exploitation; EPSS is 0.16% (4th percentile) and SSVC rates exploitation as none, making this a real-but-not-urgent issue. Because the attacker must already have the translator capability (PR:H), anonymous and default low-privileged visitors cannot trigger it.
Blind SQL injection in the Unlimited Elements for Elementor WordPress plugin (all releases before 2.0.21) allows an authenticated attacker to pass a crafted parameter that is concatenated into a SQL statement without sanitisation or escaping, letting them infer and read arbitrary data from the site database. On versions before 2.0.18 a Subscriber-level account is enough, which is significant on sites that permit open user registration, while versions 2.0.18 through 2.0.20 require a Contributor-level account or higher because 2.0.18 removed the subscriber-accessible code path. Publicly available exploit code exists, but the assessed CVSS is 6.3 with AC:H due to the slow, inference-based blind technique, EPSS is only 0.16 percent (4th percentile), SSVC records no observed exploitation, there is no CISA KEV listing, and a vendor patch (2.0.21) is available, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated attackers can modify or delete other customers' stored abandoned-cart records in the Mailchimp for WooCommerce WordPress plugin versions before 6.3, because the plugin processes cart identifiers supplied in the request without requiring authentication, a nonce, or an ownership check. Any remote actor who can reach the affected endpoint and knows or enumerates a valid cart identifier can tamper with another shopper's saved cart. Publicly available exploit code exists, though no confirmed active exploitation has been reported (CISA SSVC exploitation: none), and EPSS remains low at roughly 0.18% (7th percentile). Impact is bounded to low integrity loss - no confidentiality disclosure or server compromise - yielding a moderate CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Unauthenticated attackers can read sensitive HubSpot API response data - including correlation identifiers and cookies - from WordPress sites running the MetForm plugin before 4.3.1, because the plugin writes a debug file into the web root on every form submission whenever its HubSpot Forms integration is enabled and does not restrict access to that file. Exploitation requires the non-default HubSpot integration to be active, at least one prior form submission to populate the file, and discovery of the file's location, which is why the assessed vector is AV:N/AC:H/PR:N/UI:N with confidentiality-only impact and a low base score of 3.7. Publicly available exploit code exists, but there is no confirmed active exploitation, the SSVC assessment records exploitation as 'none' and automation as 'no', and EPSS is very low at 0.14% (3rd percentile).
Unauthenticated information disclosure in the MetForm WordPress plugin before 4.3.1 exposes stored form submission data through the plugin's REST API, allowing anyone who can reach the site's REST endpoints to read submitter information without logging in. Exploitation is trivial - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low complexity, no authentication and no user interaction - and publicly available exploit code exists, though there is no indication of confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.14% (3rd percentile). Impact is confined to confidentiality: only data that submitters previously entered on forms installed before 4.3.1 can be read, with no integrity or availability effect, making this a genuine but moderate-severity issue rather than a critical priority.
Unauthenticated SQL injection in the WordPress plugin Unlimited Elements for Elementor (versions 1.5.139 through before 2.0.21) allows remote attackers to read non-public content from the site database by supplying a crafted search value that the plugin mishandles when rewriting an already prepared SQL statement. Exploitation is conditional: a related widget option must be set away from its default value for the vulnerable code path to be reachable, which is why the assessed vector carries AC:H despite PR:N and UI:N, and why impact is limited to confidentiality (C:H) with no integrity or availability effect. Publicly available exploit code exists, but EPSS is low at 0.18% (7th percentile) and there is no KEV listing, so this is a real but conditional, moderate-priority issue rather than a top-tier emergency.
Authenticated path traversal in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 lets a privileged user (Administrator by default, or Editor when a specific non-default plugin setting is enabled) plant arbitrary files - including executable PHP - outside the intended upload directory, which can escalate to remote code execution. Exploitation requires two conditions to hold simultaneously: the attacker must already hold an account with access to the plugin's asset-management feature, and the target server must not have the PHP zip extension installed, since only the unsanitized fallback extraction path is vulnerable. Publicly available exploit code exists (tracked via WPScan), but EPSS is only 0.22% (11th percentile) and there is no CISA KEV confirmation of active exploitation, so this is a genuine but constrained risk rather than an urgent widespread threat; a vendor patch is available in version 2.0.21.
Unauthenticated information disclosure in the WP Ultimate CSV Importer WordPress plugin (versions before 9.2) lets remote attackers retrieve import-log files that contain the personal data of users previously imported from a CSV file, because the plugin derives the log storage path under the uploads directory without any site-specific secret and does not block direct web access to those files. Impact is bounded to low confidentiality (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): no write or administrative access is obtained, and only data that was actually imported and written to still-present log files can be exposed. Publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile) and the practical attack requires knowing or guessing the non-random file path and depends on a prior sensitive import having occurred; the vendor has released a fix in version 9.2.
Stored cross-site scripting in the WordPress plugin WP Ultimate CSV Importer (versions 7.17 up to, but not including, 9.2) allows an authenticated high-privilege user such as an Administrator to upload an archive whose contained files are neither type-validated nor sanitized, and which are then written to a publicly served location where they execute in the browser session of anyone who views them. The most serious configuration is WordPress Multisite, where a subsite Administrator does not hold the unfiltered_html capability, so the injected script can run in the session of a Network Super Administrator and cross a privilege boundary. Exploitation requires an authenticated Administrator-level account plus a victim who views the stored file (UI:R), publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation; overall this is a low-severity, low-priority issue, with a vendor patch available in version 9.2.
Authenticated arbitrary file read in the MPG WordPress plugin (versions before 4.2.3) allows a user holding the Editor role or higher to supply a local filesystem path in the project import 'dataset source' field, which the plugin copies into the public uploads directory where any unauthenticated visitor can then retrieve it. The issue is a path traversal (CWE-22) rated CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and publicly available exploit code exists; EPSS is low at 0.16% (5th percentile) and there is no CISA KEV listing for this CVE. Because exploitation requires a privileged account, the practical impact is a high-privilege arbitrary file read whose severity depends on what files the web server process can read, rather than a remote-unauthenticated compromise.
Stored cross-site scripting in the WordPress plugin WP Ultimate Review affects all versions before 2.4.4, where some review overview settings are written into post output without escaping. An authenticated user holding a role as low as Author can inject a persistent script payload, but only when the plugin's non-default 'author reviews' feature is explicitly enabled and only when another user - an administrator or site visitor - later renders the affected post. Publicly available exploit code exists and the WPScan/WordPress ecosystem has published an advisory, though EPSS is very low at 0.16% (5th percentile) and there is no evidence of active exploitation; this is a moderate, low-priority issue in practice given the required privileges and operator-configured precondition.
Reflected cross-site scripting in the WPC Smart Quick View for WooCommerce WordPress plugin, affecting all versions up to and including 4.4.0, lets unauthenticated attackers inject arbitrary JavaScript into a page that executes in the browser of a victim who opens a crafted URL, since the 'woosq-redirect' parameter is neither sanitized on input nor escaped on output (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is configuration-dependent: the WooCommerce 'redirect to cart after add to cart' option must be enabled for the code path that reads the parameter to run, but once it is, the '?quick-view=' auto-open mechanism means no victim interaction beyond loading the link is required, though the attacker must still lure a user into clicking (UI:R) and no attacker authentication is needed (PR:N). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a routine patch-management priority rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin (widgetpack) affects all versions up to and including 7.1.3 and lets injected JavaScript run for every visitor of any page that renders imported Google reviews. Two delivery paths are confirmed by the available data: a WordPress user with subscriber-level access or above can inject script through the 'reviews[].text' parameter, and - because the plugin's default daily cron auto-imports review content from the connected Google business profile - an unauthenticated attacker can plant the payload by posting a crafted Google review on that business, with no WordPress credentials required; our independent assessment scores this path CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (the vendor's 6.4 uses PR:L for the authenticated path). Once stored, the payload executes on DOMContentLoaded without further user interaction, though exploitation is gated by the daily import cycle, an enabled auto-import feature, an active Google Business connection, and display of the affected review block; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.
Sensitive customer data disclosure in WPZOOM Connect through 4.7.3 allows an authenticated low-privilege WooCommerce customer/subscriber to retrieve full customer card data for any arbitrary victim email, including names, WordPress user IDs, order histories, totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue is caused by the 'x-yamidoo-signature' printed by inline_js() being forgeable: an attacker registers a crafted email whose local part encodes the target timestamp and victim email, making verify_request() accept the signature; share_customer_data and identify_logged_in are enabled by default, so no non-default configuration is required. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity/availability impact, and no public exploit code or CISA KEV active exploitation was identified at time of analysis.
Stored cross-site scripting in the Ultra Addons Lite for Elementor WordPress plugin (all versions up to and including 1.3.2) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through unsanitized attributes of the plugin's Type Out widget; the script is persisted in the page and executes in the browser of any user who subsequently views it, yielding CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The flaw is a CWE-79 input-sanitization and output-escaping failure, scoped to sites that have the plugin active and that grant content-authoring accounts to untrusted users; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation currently requires deliberate attacker effort with an existing contributor account. No vendor-released patch or fixed version has been identified at time of analysis, leaving site owners dependent on removing or disabling the Type Out widget or removing the plugin until an update ships.
Unauthenticated attackers can inject and execute arbitrary WordPress shortcodes through the All in One SEO (AIOSEO) plugin in versions up to and including 5.0.2, because an attacker-controllable value is passed to do_shortcode without adequate validation when the plugin renders its breadcrumb trail on the site's search results page. The flaw is only reachable when the AIOSEO breadcrumb is actively displayed on search results via the breadcrumb block, widget, shortcode, or template tag, and the practical impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the issue is rated CVSS 6.5 (Medium), with the independent assessment treating attack complexity as higher than the vendor's vector because of the rendering precondition.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Reflected cross-site scripting in the EWWW Image Optimizer plugin for WordPress (all versions up to and including 8.7.7) lets unauthenticated remote attackers inject arbitrary script into a page by supplying a crafted REQUEST_URI parameter key that is reflected without adequate sanitization or escaping into the plugin's HelpScout Beacon script block. Per the CVSS vector (PR:N, UI:R, S:C), no attacker authentication is required, but a victim must be tricked into clicking a crafted link, and the injected script runs only in that victim's browser session - this is a reflected, not stored, issue. Two independent gating factors temper real-world priority: the plugin's enable_help option must be active (the vulnerable beacon block is emitted only when it is), and exploitation depends entirely on user interaction; reflected cross-site scripting is rated 6.1 and no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the ProfilePress WordPress plugin versions up to and including 4.17.4 allows unauthenticated attackers to inject arbitrary web scripts via a crafted POST request with a malicious ppress_billing_address filename, which executes in a victim's browser when they are tricked into clicking a link. Exploitation requires that the affected site hosts the ProfilePress Tabbed Widget; sites not using this widget are not exposed. This moderate-severity flaw (CVSS 6.1) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
Reflected cross-site scripting (XSS) in the Ivory Search - WordPress Search Plugin, affecting all versions up to and including 5.5.18, allows unauthenticated attackers to inject arbitrary web scripts via the 's' search parameter. However, exploitation requires three specific conditions: the non-default 'Highlight Search Terms' option must be enabled by an administrator, the malicious search query must return at least one post result, and a victim must be socially engineered into opening a crafted URL. These factors significantly limit realistic exploitation, and our assessment adjusts attack complexity to High despite the base CVSS score of 6.1 (Medium). No public exploit code is known at this time.
Time-based SQL injection in the SupportCandy - AI Customer Support Ticket System & Live Chatbot Agent WordPress plugin, affecting all versions up to and including 3.5.3, lets an authenticated attacker inject SQL through the unsanitized 'sort_by' parameter and use deliberate query delays to extract sensitive data from the site's database. Exploitation is gated by a non-default permission combination: the attacker must hold both a WordPress Subscriber-or-higher account and a SupportCandy Agent account explicitly granted the 'Assign Agents' capability, which confines the realistic threat to trusted-but-malicious or compromised agent accounts rather than anonymous visitors. Per CVSS 3.1 (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confidentiality-only, and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Stored cross-site scripting in the SupportCandy WordPress plugin (all versions up to and including 3.5.3) lets an authenticated attacker holding only subscriber-level access plant arbitrary JavaScript via the 'name' parameter, which then executes in the browser of any administrator or support agent who later renders the affected admin or ticket page. Because the documented exploit chain depends on the 'Register user if not exists' option being disabled - the plugin's default state - most installations sit in the vulnerable configuration, though the attacker still needs a subscriber account and must wait for a privileged victim to view the injected content. Severity is moderate (CVSS 6.4, Medium) and consistent with a routine patch-management item; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Jeg Kit for Elementor (all versions through 3.2.19) allows unauthenticated attackers to plant persistent JavaScript on WordPress sites through the plugin's comment handling path, which then executes in the browser of any user - including administrators - who later views the poisoned page. Attackers submitting from an email address that already has at least one approved comment on the site can achieve immediate persistence without moderator review, which is the precondition behind the High attack complexity rating (CVSS 5.4, AV:N/AC:H/PR:N/UI:N/S:C); other submissions still bypass sanitization but sit in the standard moderation queue. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority patch-and-remediate item rather than an emergency.
Blind SQL injection in the Beaver Builder Page Builder plugin for WordPress (versions up to and including 2.11.0.5) allows authenticated attackers with Contributor-level access or higher to extract sensitive information from the database. Exploitation requires owning a draft post of a Beaver Builder post type to obtain the fl_ajax_update nonce, and the injection is blind, meaning data must be inferred rather than read directly; no public exploit was identified at time of analysis, and the issue is a genuine but moderate-priority risk rather than a top-tier emergency. The vulnerability is rated CVSS 6.5 with confidentiality impact only (no integrity or availability impact) and is limited to sites that grant untrusted users Contributor privileges.
Unauthenticated shortcode injection in the All in One SEO (AIOSEO) WordPress plugin before 5.0.2.1 lets remote attackers smuggle registered shortcodes past the plugin's shortcode-stripping routine and have them executed in content derived from user input; on sites upgraded from older plugin versions the stripping protection is disabled entirely, so no crafted payload is required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) reflects unauthenticated, no-interaction reachability with limited confidentiality and integrity impact rather than full compromise, and the practical severity depends on which shortcodes are registered on the target (from the plugin, theme, or other plugins). Publicly available exploit code exists and a vendor patch is available in 5.0.2.1; there is no evidence of confirmed active exploitation (no CISA KEV listing), so this is best treated as a moderate-priority, patched issue with a public PoC.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated remote attackers can win a timing race against the booking/availability logic in WPdevelop's Booking Calendar WordPress plugin through version 11.8.4, producing inconsistent or corrupted booking state (integrity-only, CVSS 3.1 score 3.7). The scored vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that no credentials or user interaction are required, but success is non-deterministic and normally demands many rapid parallel requests to the public booking submission flow, with no data disclosure or availability impact. This is a low-severity, low-real-world-priority issue: there is no CISA KEV listing and no public exploit identified at time of analysis.
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.
Airano MCP Bridge, a WordPress plugin, ships an MCP bridge action that performs privileged operations without validating the caller's capabilities, so any authenticated low-privilege user (for example a Subscriber) can invoke it and modify data that should be reserved for administrators. The flaw affects all versions up to and including 2.11.0, is remotely reachable over the network with low attack complexity and no user interaction, and is rated CVSS 3.1 base 6.5 with high integrity impact but no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is gated on the attacker already holding a valid account on the target site.
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
Authenticated server-side request forgery (SSRF) in ThemeREX Addons versions up to 2.46.0 allows any logged-in WordPress user with low privileges to force the server to make arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints. The CVSS 6.4 rating reflects limited confidentiality and integrity impact, and exploitation requires the plugin to be active and an attacker to hold a valid low-privilege account. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the ThemeREX Addons WordPress plugin, affecting all versions through 2.46.0, allows an authenticated attacker with at least low-level posting privileges to inject malicious JavaScript that executes in the browser of a privileged user who views the compromised page. The vulnerability has a CVSS 3.1 base score of 6.5 and requires victim interaction; no public exploit code or active exploitation has been identified at the time of analysis. Impact is limited to browser-context script execution and does not result in server-side compromise.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Embedded sensitive data exposure in the Monetizemore Advanced Ads WordPress plugin (versions through 2.0.26) allows an authenticated low-privilege user to retrieve sensitive data embedded in plugin-controlled objects by manipulating a user-controlled key or identifier. The flaw is a CWE-639 authorization bypass (IDOR-style) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is network-reachable but requires at least low-tier authenticated credentials and yields confidentiality-only impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the issue was reported through the Patchstack vulnerability disclosure program.
Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running the Shahjada Download Manager plugin versions up to 3.3.71 by exploiting an authorization bypass through a user-controlled key (CWE-639). The vulnerability allows access to data that should be restricted, though impact is limited to confidentiality (C:L) with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Stored cross-site scripting in the Download Manager plugin for WordPress (codename065, all versions up to and including 3.3.70) allows any authenticated user with subscriber-level access or above to persist arbitrary JavaScript through the profile Display Name field, which then executes in the browser of any user - including administrators - who views the affected page or the plugin's download statistics/history screens. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms the attacker must be authenticated (PR:L) but no victim interaction is required beyond rendering the injected content, and the scope change (S:C) reflects cross-privilege execution in the administrative context. Exploitation is strictly conditional: the site must expose the [wpdm_edit_profile] shortcode on a front-end page reachable by Subscriber-level accounts, which in practice usually means open self-registration is enabled; sites lacking that shortcode placement or with registration disabled are not exploitable through this path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied, so this should be treated as a moderate, conditionally exploitable issue rather than an urgent one.
Authenticated SQL injection in the Event Tickets and Registration WordPress plugin (all versions up to and including 5.29.5) allows a contributor-level user to append arbitrary SQL to the Tickets Commerce order-listing query through the unsanitized 'orderby' parameter, enabling extraction of sensitive data from the WordPress database. The exploit path is reachable by any account holding contributor privileges or above, because the can_access_page() check only verifies that the requester authored the supplied post_id rather than requiring the edit_others_posts capability, so a contributor who publishes their own post can reach the vulnerable code without elevated rights. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with a CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confined to confidentiality, meaning read-only access to database contents with no write or denial-of-service effect.
Stored cross-site scripting in the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress (all versions up to and including 6.1.1) allows an authenticated attacker to inject arbitrary JavaScript through the 'lsd[remark]' listing parameter, which is then persisted and executed in the browser of any user who later views the affected page. Because the listing-creation branch of the plugin's AJAX handler omits a capability check and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode, the practical prerequisite collapses to merely holding any account on the site - a Subscriber account suffices, making sites with open user registration (typical for directory and classifieds deployments) the primary exposure. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); the CVSS 3.1 score is 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Sensitive information exposure in the Otter Blocks WordPress plugin (all versions up to and including 3.2.6) allows any authenticated user with subscriber-level access or above to retrieve the email addresses and submission dates of the five most recent form submitters, along with the site's total form submission count, by manipulating the 'otter_form_widget_filter' parameter. The vulnerable widget is registered whenever the themeisle_blocks_form_emails option is non-empty - the normal state on any site that has saved a Form block - so the exposure is live on standard sites using the plugin's form feature. No public exploit identified at time of analysis, and no evidence of active exploitation; the exposed data set is small and fixed, and the independent assessment rates real-world risk as consistently low (low-severity information disclosure under CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Authenticated SQL injection in MultiVendorX (Dc WooCommerce Multi Vendor) 5.0.18 and earlier allows a vendor-level user holding the 'edit_stores' capability to inject arbitrary SQL through the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint, enabling extraction of sensitive data from the WordPress database. The flaw carries a CVSS 3.1 base score of 6.5 (network-reachable, low privileges required, high confidentiality impact, no integrity or availability impact) and there is no public exploit identified at time of analysis. Exposure is limited to sites running an affected version with the MarketplaceCompliance module active; sites that never use the report-abuse feature, or that have updated past 5.0.18, are not affected, and the realistic threat is a malicious or compromised vendor account rather than an unauthenticated internet-wide attacker.
Reflected cross-site scripting in the Greenshift - animation and page builder blocks WordPress plugin (all versions up to and including 13.2.0) allows an unauthenticated remote attacker to inject arbitrary script that is echoed unescaped inside a <script type="module"> tag when the '{{GET:...}}' dynamic placeholder is used in an element block's Custom JS field. Exploitation is conditional rather than universal: a site administrator must previously have configured a block's Custom JS to include a {{GET:...}} placeholder and that JavaScript must contain the token 'import', and the victim must then be tricked into visiting an attacker-crafted link (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; base 6.1 per the vendor CVE record). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the realistically exposed population is the subset of Greenshift ≤13.2.0 sites that use {{GET:}} placeholders in Custom JS containing 'import'.
The MStore API WordPress plugin (versions before 4.22.1) fails to restrict which order fields a customer may update, allowing any authenticated customer to mark their own unpaid order as paid or fulfilled and receive goods without paying; no admin rights or victim interaction are needed. Exploitation requires only a self-registerable customer account and an existing unpaid order belonging to the attacker, matching the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3) and bounding the impact to payment fraud rather than account takeover or data exposure. Publicly available exploit code exists according to WPScan, but there is no indication of confirmed active exploitation (the CVE is not in CISA KEV).
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). Exposure is greatest on builds below 2.0.18, where a Subscriber account - trivially obtainable on any site with open registration - is sufficient; from 2.0.18 through 2.0.20 the minimum role rises to Contributor or above. There is no CISA KEV entry, so confirmed active exploitation in the wild has not been established.
Unauthenticated attackers can manipulate gift-card amounts in WebToffee Gift Cards for WooCommerce before 1.3.1 to bypass configured denominations and reduce or eliminate order totals, obtaining products without full payment. Publicly available exploit code exists, and the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms remote, unauthenticated, no-user-interaction exploitation with low integrity impact only. The affected component requires WordPress with the vulnerable plugin and WooCommerce gift-card purchasing enabled; no server or data compromise is involved.
Price manipulation in the Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 lets remote attackers set an arbitrarily low purchase price by editing a client-supplied amount field that the plugin never recomputes on the server, so a buyer can pay far less than the merchant intended. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) and affects any site running the plugin at a version below 2.0.6 with an exposed checkout. Impact is limited to transaction integrity and direct financial loss to the merchant - no data confidentiality or availability impact - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV).