WordPress
Monthly
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
PHP object injection in the WordPress plugin Pay with Vipps for WooCommerce (wp_hosting_as:pay_with_vipps_for_woocommerce, all versions through 6.2.0) allows an attacker to supply crafted serialized data to a plugin code path that deserializes it without validation. Per the assessed CVSS:3.1 vector (7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), exploitation requires an authenticated account with high privileges - effectively a WordPress administrator or equivalent capability - on a site where the plugin is installed and active, and it yields high confidentiality, integrity and availability impact; no user interaction is required. Practical exploitation further depends on a usable PHP POP gadget chain being present in WordPress core, WooCommerce or another installed component, and no public exploit code or CISA KEV entry was identified at time of analysis, so the high privilege prerequisite is the primary limiting factor.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
Reflected cross-site scripting in the FiboSearch (ajax-search-for-woocommerce) WordPress plugin, affecting all versions through 1.34.1, allows an unauthenticated attacker to execute arbitrary script in a victim's browser session by convincing them to open a crafted link against an affected WooCommerce store. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, scored 7.1 by the reporter Patchstack) confirms the attack is network-reachable and needs no attacker-side authentication, but it critically depends on victim interaction and the impact is confined to the victim's session rather than the server; our independent assessment concurs and only differs by rating availability impact as None. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. No public exploit identified at time of analysis; the primary impact is integrity, as attackers can forge trusted state but cannot read data or cause service disruption.
Denial-of-service condition in WP Rocket versions before 3.23.5 can be triggered by unauthenticated remote attackers with no user interaction, according to the assessed CVSS vector; however, the advisory and CWE-624 label also carry a 'Code Injection' claim that conflicts with the availability-only impact and remains unverified. The affected product is the WP Rocket WordPress plugin from WP Media, and the supplied intelligence does not indicate CISA KEV active exploitation; no public exploit code identified at time of analysis. Because the vector scores C:N/I:N/A:H, treat the confirmed impact as resource-exhaustion/DoS rather than data compromise or site takeover unless code-injection evidence emerges.
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Reflected cross-site scripting in the aBlocks plugin for WordPress (versions through 2.16.0) lets an unauthenticated remote attacker run arbitrary script in a victim's browser by enticing them to open a crafted link, as the malicious input is echoed back in the generated page rather than stored (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation hinges on victim interaction, and the highest-impact scenario is luring a logged-in administrator, whose hijacked browser session can be used to perform privileged actions against the site. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score or known exploitation activity was supplied in the available intelligence.
PHP object injection in the MainWP Child plugin through version 6.2.1 allows unauthenticated remote attackers to fully compromise confidentiality, integrity, and availability, though exploitation requires user interaction and a viable PHP gadget chain. The vulnerability is a deserialization of untrusted data (CWE-502) issue with a CVSS 3.1 base score of 8.8, rated high risk. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in the WPMU DEV Forminator WordPress plugin, affecting all versions through 1.57.3, lets an unauthenticated attacker craft a malicious page that, when visited by a logged-in site administrator, silently submits state-changing requests to the vulnerable site on that administrator's behalf. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N), reflecting high integrity impact offset by the required victim interaction and no availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied. Risk is bounded by the interaction requirement: the attack fails if the targeted privileged user is not currently authenticated in a browser session while visiting the attacker-controlled page.
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
Authentication bypass in the Ultimate Multisite WordPress plugin before 2.17.0 lets an unauthenticated remote attacker (CVSS PR:N) log in as any existing WordPress account, including a Network Super Admin, whose email address they know - but only on sites whose checkout form is configured without a password field and only when the target account has no existing Ultimate Multisite customer record. The root cause is that the plugin's duplicate-account check normalizes the submitted email address differently from the lookup used to create the customer, so a logged-out checkout silently links to and authenticates as the matching existing WordPress user. The 2.15.1 fix for CVE-2026-75957 does not remediate this bypass; vendor-released patch 2.17.0 is available, and no public exploit code has been identified at time of analysis (no CISA KEV entry). Vendor CVSS is 9.8, though our independent assessment applies AC:H (8.1) because both the password-less checkout configuration and the absence of a pre-existing customer record are required.
Stored cross-site scripting in the GPTranslate WordPress plugin (versions below 2.34.14) lets unauthenticated attackers submit translation strings that the plugin stores without proper authorization checks and later renders without output escaping, so malicious JavaScript executes in the browser of any user who views a poisoned translated page. The flaw is only reachable when the plugin's server-side translations feature is enabled, meaning sites relying on client-side translation are not exposed, and successful abuse still depends on a victim subsequently loading the affected page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; a vendor patch is available in version 2.34.14.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization in the WPMU DEV Forminator WordPress plugin (all versions through 1.57.2) allows unauthenticated remote attackers to perform privileged actions that should require an access-control check, altering site data with a high integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, exploitation requires only that a vulnerable Forminator installation be network-reachable; no credentials or victim interaction are needed, though the impact is confined to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV), making this a moderate-priority, broadly-reachable issue rather than an emergency.
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is driven primarily by sites that permit self-registration or retain low-privilege accounts they do not tightly control.
Reflected cross-site scripting in the Everest Forms WordPress plugin through version 3.6.1 lets remote, unauthenticated attackers run arbitrary script in a victim's browser when that victim opens a specially crafted URL. Successful exploitation requires the victim to actively click or open the malicious link (UI:R) on a site running an affected version, and because the payload is reflected rather than stored it must be re-triggered per victim per click; the impact is confined to the browser session and the site's origin (scope changed) rather than server-side compromise. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation requires no attacker credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
SQL injection in the Paid Member Subscriptions WordPress plugin through version 3.1.1 allows authenticated subscriber-level users to execute crafted SQL queries and read sensitive data from the site's database. The independent assessment gives a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (reported base 8.5), meaning confidentiality is high while integrity and availability impact are low and scope is unchanged. Exploitation requires only any valid subscriber account, which is typically easy to obtain on sites using this plugin for open self-service registration; no public exploit identified at time of analysis.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated privilege escalation in the Salon Booking System WordPress plugin (versions 10.31.7 and earlier) allows remote attackers to elevate privileges by inducing a victim to trigger a crafted request, due to incorrect privilege assignment (CWE-266) in the plugin's role handling. The attack requires user interaction (UI:R) but no authentication (PR:N), and affects any WordPress site with the vulnerable plugin active. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited, yet the high CVSS score (8.8) and potential for significant site compromise warrant prompt remediation.
Cross-site scripting in the WP Mailster WordPress plugin (all versions up to and including 1.9.0.0) allows an unauthenticated remote attacker to inject script content that executes in the browser of a victim WordPress user, enabling session hijacking, content tampering, redirection to malicious sites, or actions performed with the victim's privileges. Exploitation is not automatic: the attacker must induce a user to click a crafted link or load a page that renders the injected payload (CVSS UI:R), and the target must actually be running the vulnerable plugin, though no attacker authentication is required (PR:N). The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no public exploit code has been identified at time of analysis, and the flaw is tracked as CWE-79 with an EUVD record (EUVD-2026-93086) and a Patchstack-issued advisory.
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.
Unauthenticated cross-site scripting in the WordPress plugin Form Block (vendor epiphyt, all versions through 1.8.1) lets remote attackers inject script that executes in a victim's browser, carrying a published CVSS base score of 7.1. No authentication is required (PR:N), but exploitation depends on victim interaction (UI:R) - the targeted user must load or interact with the attacker-controlled content before the payload runs - and the impact is limited to the victim's browser session rather than the server, with the assessed vector narrowing availability impact to A:N. No public exploit code and no confirmed active exploitation (the plugin is not listed in CISA KEV) were identified at the time of analysis.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Unauthenticated cross-site scripting in the picu WordPress plugin (versions up to and including 3.10.1) allows remote attackers to inject malicious scripts that execute in a victim's browser session when they interact with a crafted link or view attacker-controlled content. Exploitation requires victim user interaction, but the attacker needs no authentication, and the vulnerability has a changed scope (S:C) with low confidentiality and integrity impact. This moderate-severity issue (CVSS 7.1) was reported by Patchstack, and no public exploit identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. No public exploit is identified at time of analysis, and the risk is primarily opportunistic mass scanning against internet-facing instances rather than targeted data theft or code execution.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Broken access control in the WPO365 WordPress plugin through version 44.1 lets an authenticated Subscriber-level account reach data or functionality beyond its assigned role, with the CVSS 3.1 vector indicating high confidentiality impact and a scope change. Exploitation is network-reachable and low-complexity requiring only a low-privilege account, with no user interaction needed; however, sites that disable self-registration or have no untrusted low-tier users substantially limit exposure. The CVE carries a HIGH base score of 8.5, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network attackers to obtain elevated privileges on affected sites, with the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1 High) indicating no authentication or user interaction but high attack complexity. The underlying issue is CWE-266 incorrect privilege assignment, and successful exploitation depends on a condition outside the attacker's control such as a race condition, predictable value, or specific plugin/site state; the exact trigger was not disclosed in the provided data. No public exploit identified at time of analysis.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Broken access control in the Progress Planner WordPress plugin through version 1.10.0 allows any authenticated user holding the low-privileged Subscriber role (or higher) to reach plugin functionality they are not authorized to invoke, yielding high impact to confidentiality, integrity, and availability at a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is network-reachable, requires no user interaction and no elevated privileges beyond a valid low-privilege session, and is classified as CWE-862 (Missing Authorization); risk is greatest on sites that permit open or self-service registration and materially lower where account creation is locked down. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation in CISA KEV; the report originates from Patchstack. Authentication requirements are confirmed from the assessed vector, which carries PR:L, so exploitation is authenticated but does not require administrative access.
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Cross-site scripting (CWE-79) in the Social Rocket WordPress plugin through version 1.3.5 lets an unauthenticated attacker deliver a script payload that executes in a victim's browser session once that victim is enticed to click a crafted link or view attacker-influenced content rendered through the plugin (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:C, scope changed). No credentials are required to construct or deliver the payload, but the script only runs with the privileges of the social-engineered user, so real-world impact is bounded by the role and session of whoever is tricked. This is not a CISA KEV entry and no public exploit code has been identified at time of analysis; the disclosure is medium/moderate risk and the underlying advisory does not clarify whether the injection point is reflected or stored, which determines how the lure must be delivered.
Unauthenticated SQL injection in ARMember Premium versions 7.8 and earlier allows remote attackers to execute arbitrary SQL queries against the underlying WordPress database, potentially exposing sensitive information. The flaw requires no authentication (PR:N) or user interaction (UI:N), and its scope change (S:C) indicates the database is a security authority distinct from the web application. No public exploit identified at time of analysis, but the CVSS score of 9.3 reflects the high confidentiality impact.
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Porto Theme Functionality WordPress plugin affects versions up to and including 3.9.3, allowing remote attackers to inject arbitrary SQL into the plugin's database queries without any prior authentication (CVSS vector PR:N, no user interaction). Successful exploitation can expose sensitive data stored in the site's WordPress database - the independent assessment rates confidentiality impact as High and integrity impact as Low, while the vendor/feed score of 9.3 assumes scope change and a different impact mix; both agree the issue is trivially network-reachable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-severity, easily reachable flaw rather than a confirmed actively exploited campaign, and no fixed plugin version is specified in the supplied advisory data.
SQL injection in the ListingPro WordPress plugin through version 2.9.12 allows an authenticated Subscriber-level attacker to inject arbitrary SQL through a plugin code path, exposing database contents such as user credentials hashes, listing records, and site configuration. Exploitation requires a valid Subscriber account, which is easy to obtain on sites with self-registration enabled, and only WordPress installations where the plugin is installed and activated are exposed; sites upgraded past 2.9.12 are not affected. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); the issue is genuinely actionable but below top-tier urgency, with the practical risk concentrated on open-registration membership and directory sites.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
Unauthenticated sensitive data exposure in the Museder RestoreOne WordPress plugin (versions up to 2.7.276) allows remote attackers to access confidential information without authentication. With a CVSS score of 7.5 (High), the flaw requires no user interaction and has high confidentiality impact (C:H) but no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the risk is confined to WordPress sites with this specific plugin installed.
Unauthenticated remote attackers can access backup data from WordPress sites running the WXD Backup Lite plugin versions 1.0.2 and earlier due to a missing authorization check (CWE-862). The flaw carries a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact only, and exploitation requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low-complexity nature and unauthenticated access make it a significant risk for affected sites.
Unauthenticated sensitive data exposure in SafeSnap - Verified WordPress Backup & Restore 2.1.2 and earlier allows remote attackers to retrieve confidential information from affected WordPress sites. The flaw, tracked as CVE-2026-41559 and categorized as CWE-201 (insertion of sensitive information into sent data), has a CVSS base score of 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact without requiring authentication or user interaction. No public exploit code or active exploitation was identified at time of analysis, but the low complexity and network reachability make timely patching important.
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
Reflected cross-site scripting in the VikBooking Hotel Booking Engine & PMS WordPress plugin (all versions through 1.8.14) allows a remote attacker to inject script into a page rendered by the target site, which then executes in the browser of any user who follows a crafted link. According to the independent assessment, exploitation is gated by user interaction (CVSS UI:R, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must deliver the link to a victim and have it loaded in that victim's browser - impact is greatest when the victim is a logged-in administrator, whose session could be abused under the changed-scope condition. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the reporter (Patchstack) rates the issue 7.1.
PHP object injection in the WordPress plugin Pay with Vipps for WooCommerce (wp_hosting_as:pay_with_vipps_for_woocommerce, all versions through 6.2.0) allows an attacker to supply crafted serialized data to a plugin code path that deserializes it without validation. Per the assessed CVSS:3.1 vector (7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), exploitation requires an authenticated account with high privileges - effectively a WordPress administrator or equivalent capability - on a site where the plugin is installed and active, and it yields high confidentiality, integrity and availability impact; no user interaction is required. Practical exploitation further depends on a usable PHP POP gadget chain being present in WordPress core, WooCommerce or another installed component, and no public exploit code or CISA KEV entry was identified at time of analysis, so the high privilege prerequisite is the primary limiting factor.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
Reflected cross-site scripting in the FiboSearch (ajax-search-for-woocommerce) WordPress plugin, affecting all versions through 1.34.1, allows an unauthenticated attacker to execute arbitrary script in a victim's browser session by convincing them to open a crafted link against an affected WooCommerce store. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, scored 7.1 by the reporter Patchstack) confirms the attack is network-reachable and needs no attacker-side authentication, but it critically depends on victim interaction and the impact is confined to the victim's session rather than the server; our independent assessment concurs and only differs by rating availability impact as None. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. No public exploit identified at time of analysis; the primary impact is integrity, as attackers can forge trusted state but cannot read data or cause service disruption.
Denial-of-service condition in WP Rocket versions before 3.23.5 can be triggered by unauthenticated remote attackers with no user interaction, according to the assessed CVSS vector; however, the advisory and CWE-624 label also carry a 'Code Injection' claim that conflicts with the availability-only impact and remains unverified. The affected product is the WP Rocket WordPress plugin from WP Media, and the supplied intelligence does not indicate CISA KEV active exploitation; no public exploit code identified at time of analysis. Because the vector scores C:N/I:N/A:H, treat the confirmed impact as resource-exhaustion/DoS rather than data compromise or site takeover unless code-injection evidence emerges.
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Reflected cross-site scripting in the aBlocks plugin for WordPress (versions through 2.16.0) lets an unauthenticated remote attacker run arbitrary script in a victim's browser by enticing them to open a crafted link, as the malicious input is echoed back in the generated page rather than stored (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation hinges on victim interaction, and the highest-impact scenario is luring a logged-in administrator, whose hijacked browser session can be used to perform privileged actions against the site. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score or known exploitation activity was supplied in the available intelligence.
PHP object injection in the MainWP Child plugin through version 6.2.1 allows unauthenticated remote attackers to fully compromise confidentiality, integrity, and availability, though exploitation requires user interaction and a viable PHP gadget chain. The vulnerability is a deserialization of untrusted data (CWE-502) issue with a CVSS 3.1 base score of 8.8, rated high risk. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in the WPMU DEV Forminator WordPress plugin, affecting all versions through 1.57.3, lets an unauthenticated attacker craft a malicious page that, when visited by a logged-in site administrator, silently submits state-changing requests to the vulnerable site on that administrator's behalf. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N), reflecting high integrity impact offset by the required victim interaction and no availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied. Risk is bounded by the interaction requirement: the attack fails if the targeted privileged user is not currently authenticated in a browser session while visiting the attacker-controlled page.
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
Authentication bypass in the Ultimate Multisite WordPress plugin before 2.17.0 lets an unauthenticated remote attacker (CVSS PR:N) log in as any existing WordPress account, including a Network Super Admin, whose email address they know - but only on sites whose checkout form is configured without a password field and only when the target account has no existing Ultimate Multisite customer record. The root cause is that the plugin's duplicate-account check normalizes the submitted email address differently from the lookup used to create the customer, so a logged-out checkout silently links to and authenticates as the matching existing WordPress user. The 2.15.1 fix for CVE-2026-75957 does not remediate this bypass; vendor-released patch 2.17.0 is available, and no public exploit code has been identified at time of analysis (no CISA KEV entry). Vendor CVSS is 9.8, though our independent assessment applies AC:H (8.1) because both the password-less checkout configuration and the absence of a pre-existing customer record are required.
Stored cross-site scripting in the GPTranslate WordPress plugin (versions below 2.34.14) lets unauthenticated attackers submit translation strings that the plugin stores without proper authorization checks and later renders without output escaping, so malicious JavaScript executes in the browser of any user who views a poisoned translated page. The flaw is only reachable when the plugin's server-side translations feature is enabled, meaning sites relying on client-side translation are not exposed, and successful abuse still depends on a victim subsequently loading the affected page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; a vendor patch is available in version 2.34.14.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization in the WPMU DEV Forminator WordPress plugin (all versions through 1.57.2) allows unauthenticated remote attackers to perform privileged actions that should require an access-control check, altering site data with a high integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, exploitation requires only that a vulnerable Forminator installation be network-reachable; no credentials or victim interaction are needed, though the impact is confined to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV), making this a moderate-priority, broadly-reachable issue rather than an emergency.
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
PHP object injection in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 lets an authenticated low-privilege user pass attacker-controlled data into an unsafe PHP deserialization path, resulting in high confidentiality, integrity, and availability impact per the vendor-assigned CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a logged-in WordPress account with at least low privileges on a site running an affected plugin version, and no end-user interaction is needed; realistic exploitation further depends on the presence of a usable POP gadget chain in the plugin, Elementor, or WordPress core, which is not confirmed by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is driven primarily by sites that permit self-registration or retain low-privilege accounts they do not tightly control.
Reflected cross-site scripting in the Everest Forms WordPress plugin through version 3.6.1 lets remote, unauthenticated attackers run arbitrary script in a victim's browser when that victim opens a specially crafted URL. Successful exploitation requires the victim to actively click or open the malicious link (UI:R) on a site running an affected version, and because the payload is reflected rather than stored it must be re-triggered per victim per click; the impact is confined to the browser session and the site's origin (scope changed) rather than server-side compromise. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation requires no attacker credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Unauthenticated attackers can forge payment-notification callbacks to the Nexi XPay Build WordPress plugin (through version 7.6.2) and mark arbitrary WooCommerce orders as paid - or downgrade genuinely paid orders to a failed status - because the plugin skips its security-token comparison whenever the targeted order has no stored token. The issue is remotely reachable at low complexity with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5), and the impact is purely integrity-based: no confidentiality loss, but direct tampering with order and payment state on the store. Publicly available exploit code exists; however, no CISA KEV listing or other confirmation of active exploitation is present in the supplied intelligence, and exploitation is constrained to orders that happen to be in the tokenless condition.
Unauthenticated payment-result forgery in the Nexi XPay Build WordPress plugin through 7.6.2 lets any remote attacker mark arbitrary orders as paid or failed, cancel those orders at will, and retrieve the order keys that unlock guest buyers' personal details. The vulnerable surface is the plugin's payment-result handling routes, which accept a supplied payment result without verifying it, so no credentials, user interaction, or non-default configuration are needed beyond a site running the plugin as an active Nexi XPay gateway. Publicly available exploit code exists via the WPScan advisory, and although there is no confirmed active exploitation (not listed in CISA KEV), the high integrity impact on order state and the exposure of guest customer data make this an actionable priority; exploitation is limited in practice only by the narrow installed base of this specific gateway plugin.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.4.4 through below 1.10.2) lets an unauthenticated attacker supply a value whose URL scheme is not validated, which is then reflected into a link on a plugin admin page and executed as arbitrary JavaScript in the browser of a logged-in administrator who opens a crafted link. Publicly available exploit code exists and is documented in the WPScan advisory (also tracked as ENISA EUVD-2026-94188), so this is a non-persistent, socially-engineered attack that must be delivered to each victim individually rather than mass-exploited. The assessed CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, with no availability impact in our assessment) reflects the scope change inherent to XSS in a privileged admin context, but the practical impact is bounded by the user-interaction prerequisite and by the fact that a privileged WordPress user must be lured into clicking the link.
Privilege escalation in the Koinonia Link WordPress plugin (versions 1.1.2 through earlier than 1.1.5) lets any authenticated user, including a low-privileged subscriber, grant themselves the Administrator role by tampering with the role value submitted during a profile update. The flaw is a missing authorization check on the role-save routine (CWE-269), not a memory-safety or injection bug, and it is remotely reachable with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), meaning successful exploitation yields total control of the WordPress site. Publicly available exploit code exists and the vendor has released a fix in 1.1.5; the practical barrier is only the need for a valid account, so sites with open self-service registration are exposed to unauthenticated attackers who simply register first, while sites with registration disabled limit the threat to existing users.
Reflected cross-site scripting in the Magee Shortcodes WordPress plugin through version 2.1.1 lets unauthenticated attackers inject script into pages by abusing AJAX actions that reflect unsanitised user input back to the browser. Exploitation requires a victim with an active session to be socially engineered into clicking a crafted link pointing at one of the plugin's unauthenticated AJAX endpoints, and the resulting impact is bounded by that victim's privileges - a moderated session yields limited damage, while an administrator session could enable actions such as session or content manipulation. CVSS 3.1 scores the issue 7.1 (AV:N/AC:L/PR:N/UI:R/S:C), WPScan is credited with the report, and publicly available exploit code exists, though there is no evidence of confirmed active exploitation (CISA KEV) and no vendor-released fixed version has been identified at time of analysis.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
SQL injection in the Paid Member Subscriptions WordPress plugin through version 3.1.1 allows authenticated subscriber-level users to execute crafted SQL queries and read sensitive data from the site's database. The independent assessment gives a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (reported base 8.5), meaning confidentiality is high while integrity and availability impact are low and scope is unchanged. Exploitation requires only any valid subscriber account, which is typically easy to obtain on sites using this plugin for open self-service registration; no public exploit identified at time of analysis.
Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.
Unauthenticated privilege escalation in the Salon Booking System WordPress plugin (versions 10.31.7 and earlier) allows remote attackers to elevate privileges by inducing a victim to trigger a crafted request, due to incorrect privilege assignment (CWE-266) in the plugin's role handling. The attack requires user interaction (UI:R) but no authentication (PR:N), and affects any WordPress site with the vulnerable plugin active. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited, yet the high CVSS score (8.8) and potential for significant site compromise warrant prompt remediation.
Cross-site scripting in the WP Mailster WordPress plugin (all versions up to and including 1.9.0.0) allows an unauthenticated remote attacker to inject script content that executes in the browser of a victim WordPress user, enabling session hijacking, content tampering, redirection to malicious sites, or actions performed with the victim's privileges. Exploitation is not automatic: the attacker must induce a user to click a crafted link or load a page that renders the injected payload (CVSS UI:R), and the target must actually be running the vulnerable plugin, though no attacker authentication is required (PR:N). The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no public exploit code has been identified at time of analysis, and the flaw is tracked as CWE-79 with an EUVD record (EUVD-2026-93086) and a Patchstack-issued advisory.
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.
Unauthenticated cross-site scripting in the WordPress plugin Form Block (vendor epiphyt, all versions through 1.8.1) lets remote attackers inject script that executes in a victim's browser, carrying a published CVSS base score of 7.1. No authentication is required (PR:N), but exploitation depends on victim interaction (UI:R) - the targeted user must load or interact with the attacker-controlled content before the payload runs - and the impact is limited to the victim's browser session rather than the server, with the assessed vector narrowing availability impact to A:N. No public exploit code and no confirmed active exploitation (the plugin is not listed in CISA KEV) were identified at the time of analysis.
Privilege escalation in the WordPress plugin Import and Export Users and Customers (versions through 2.5.5) allows an authenticated Editor-level account to assign itself or another user the administrator role by abusing the plugin's user import/export functionality, a CWE-266 incorrect privilege assignment flaw rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional: the attacker needs a pre-existing high-privilege account (Editor or comparable), the plugin installed and active, and no user interaction is required once that session exists. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, so the practical risk is a serious but situational escalation on multi-author or multi-tenant WordPress sites that delegate Editor accounts to less-trusted users rather than a broad internet-facing emergency.
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Unauthenticated requests to the WordPress picu plugin (versions up to and including 3.10.1) can reach plugin functionality that is supposed to be protected by an authorization check, letting any remote visitor perform an action the plugin intended to reserve for a privileged or otherwise authorized user. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, with Low confidentiality, integrity and availability impact and S:U) confirms that no credentials, no user interaction and no non-default configuration are required, so any reachable installation is exposed, though the resulting impact is bounded rather than a full site takeover - the specific protected action gated by the missing check is not identified in the available data. There is no public exploit identified at time of analysis and no CISA KEV listing; real-world risk is constrained mainly by the small install base of this specialized client-proofing plugin and by the Low severity of each impact metric.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Unauthenticated cross-site scripting in the picu WordPress plugin (versions up to and including 3.10.1) allows remote attackers to inject malicious scripts that execute in a victim's browser session when they interact with a crafted link or view attacker-controlled content. Exploitation requires victim user interaction, but the attacker needs no authentication, and the vulnerability has a changed scope (S:C) with low confidentiality and integrity impact. This moderate-severity issue (CVSS 7.1) was reported by Patchstack, and no public exploit identified at time of analysis.
Unauthenticated cross-site scripting (XSS) in the Charitable WordPress plugin through version 1.8.12.3 allows remote attackers to inject arbitrary web scripts into pages viewed by victims, potentially leading to session hijacking or defacement. Exploitation requires user interaction (UI:R), such as clicking a crafted link, and impacts the victim's browser session rather than the server (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority issue per independent assessment.
Unauthorized action execution in PowerPress Podcasting (≤11.17.9) allows unauthenticated network attackers to bypass access controls with low integrity and availability impact, as the plugin fails to enforce authorization (CWE-862). Affected are WordPress sites running the plugin; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, but there is no confidentiality impact and only low integrity/availability impact. No public exploit is identified at time of analysis, and the risk is primarily opportunistic mass scanning against internet-facing instances rather than targeted data theft or code execution.
Unauthenticated sensitive data exposure in the Groundhogg WordPress plugin versions 4.8.3 and earlier allows remote attackers to retrieve confidential information from affected sites. Tracked as CVE-2026-104385 with a CVSS score of 7.5, the flaw requires no authentication or user interaction and can be exploited over the network with low complexity. No public exploit identified at time of analysis, but the high confidentiality impact (CWE-201) makes prompt remediation critical.
Broken access control in the WPO365 WordPress plugin through version 44.1 lets an authenticated Subscriber-level account reach data or functionality beyond its assigned role, with the CVSS 3.1 vector indicating high confidentiality impact and a scope change. Exploitation is network-reachable and low-complexity requiring only a low-privilege account, with no user interaction needed; however, sites that disable self-registration or have no untrusted low-tier users substantially limit exposure. The CVE carries a HIGH base score of 8.5, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network attackers to obtain elevated privileges on affected sites, with the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1 High) indicating no authentication or user interaction but high attack complexity. The underlying issue is CWE-266 incorrect privilege assignment, and successful exploitation depends on a condition outside the attacker's control such as a race condition, predictable value, or specific plugin/site state; the exact trigger was not disclosed in the provided data. No public exploit identified at time of analysis.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Broken access control in the Progress Planner WordPress plugin through version 1.10.0 allows any authenticated user holding the low-privileged Subscriber role (or higher) to reach plugin functionality they are not authorized to invoke, yielding high impact to confidentiality, integrity, and availability at a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is network-reachable, requires no user interaction and no elevated privileges beyond a valid low-privilege session, and is classified as CWE-862 (Missing Authorization); risk is greatest on sites that permit open or self-service registration and materially lower where account creation is locked down. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation in CISA KEV; the report originates from Patchstack. Authentication requirements are confirmed from the assessed vector, which carries PR:L, so exploitation is authenticated but does not require administrative access.
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Unauthenticated, network-reachable requests can abuse a missing authorization check in the Easy Digital Downloads WordPress plugin (versions up to and including 3.7.1) to perform actions that should require a privileged, logged-in user, giving attackers an integrity-only impact consistent with the 7.5 CVSS 3.1 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Any WordPress site with the plugin installed and active at or below 3.7.1 is in scope, and exploitation requires no credentials, no privileges, and no victim interaction; the trade-off is that no data disclosure or denial of service is expected, so the realistic blast radius is unauthorized modification of site/e-commerce data rather than full compromise. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the specific protected action that is exposed is not detailed in the available intelligence, so affected versions should be treated as unauthorized-write capable until a fix is confirmed.
Unauthenticated cross-site scripting in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin affects versions 4.4.6 and earlier, allowing remote attackers to inject script that executes in a victim's browser when that victim interacts with attacker-controlled input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), no authentication is required and the attacker is remote, but exploitation is gated on user interaction - a site visitor or logged-in administrator must click a crafted link or submit a poisoned request that the plugin renders without proper sanitization; no victim action means no code execution. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, so it should be treated as a moderate-severity, moderate-priority plugin hardening issue rather than an emergency, though the scope-change characteristic (S:C) means successful script execution can reach beyond the vulnerable component into the hosting WordPress site's origin.
Reflected cross-site scripting in the WooCommerce Simple Auctions WordPress plugin (versions up to and including 3.0.10) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user tricked into loading a crafted link or input, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (score 7.1). The mandatory user interaction (UI:R) is the primary limiting factor - the attacker must deliver a malicious URL to a victim - while the absence of authentication requirements (PR:N) means any internet-facing WordPress site with the plugin active is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the highest-value abuse path would be luring an authenticated administrator to a crafted link to leverage their session privileges.
Unauthenticated cross-site scripting in the WordPress plugin Video Background Block (versions 2.0.3 and earlier) lets remote attackers supply data to the plugin's video-background section rendering that is not properly neutralized before being written into a page, so arbitrary script executes in the browser of any visitor who loads the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms no authentication is required to deliver the payload but that exploitation depends on a victim loading or interacting with the crafted page, and the scope change indicates the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory as reported does not cite a fixed version, so risk is confined to WordPress sites running this specific bplugins plugin at an unpatched release.
Cross-site scripting (CWE-79) in the Social Rocket WordPress plugin through version 1.3.5 lets an unauthenticated attacker deliver a script payload that executes in a victim's browser session once that victim is enticed to click a crafted link or view attacker-influenced content rendered through the plugin (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:C, scope changed). No credentials are required to construct or deliver the payload, but the script only runs with the privileges of the social-engineered user, so real-world impact is bounded by the role and session of whoever is tricked. This is not a CISA KEV entry and no public exploit code has been identified at time of analysis; the disclosure is medium/moderate risk and the underlying advisory does not clarify whether the injection point is reflected or stored, which determines how the lure must be delivered.
Unauthenticated SQL injection in ARMember Premium versions 7.8 and earlier allows remote attackers to execute arbitrary SQL queries against the underlying WordPress database, potentially exposing sensitive information. The flaw requires no authentication (PR:N) or user interaction (UI:N), and its scope change (S:C) indicates the database is a security authority distinct from the web application. No public exploit identified at time of analysis, but the CVSS score of 9.3 reflects the high confidentiality impact.
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Porto Theme Functionality WordPress plugin affects versions up to and including 3.9.3, allowing remote attackers to inject arbitrary SQL into the plugin's database queries without any prior authentication (CVSS vector PR:N, no user interaction). Successful exploitation can expose sensitive data stored in the site's WordPress database - the independent assessment rates confidentiality impact as High and integrity impact as Low, while the vendor/feed score of 9.3 assumes scope change and a different impact mix; both agree the issue is trivially network-reachable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-severity, easily reachable flaw rather than a confirmed actively exploited campaign, and no fixed plugin version is specified in the supplied advisory data.
SQL injection in the ListingPro WordPress plugin through version 2.9.12 allows an authenticated Subscriber-level attacker to inject arbitrary SQL through a plugin code path, exposing database contents such as user credentials hashes, listing records, and site configuration. Exploitation requires a valid Subscriber account, which is easy to obtain on sites with self-registration enabled, and only WordPress installations where the plugin is installed and activated are exposed; sites upgraded past 2.9.12 are not affected. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); the issue is genuinely actionable but below top-tier urgency, with the practical risk concentrated on open-registration membership and directory sites.
Unauthenticated sensitive data exposure in the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin (versions 1.3.2 and earlier) allows remote attackers to retrieve information the plugin transmits without adequate protection, yielding a high confidentiality impact with no integrity or availability impact. The flaw is remotely reachable, requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), and is rooted in CWE-201, the insertion of sensitive information into sent data. Exposure is limited to WordPress sites that have this specific backup/restore/migrate plugin installed and active; no public exploit identified at time of analysis, and no EPSS, KEV or proof-of-concept data was provided with the source material.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
Unauthenticated sensitive data exposure in the Museder RestoreOne WordPress plugin (versions up to 2.7.276) allows remote attackers to access confidential information without authentication. With a CVSS score of 7.5 (High), the flaw requires no user interaction and has high confidentiality impact (C:H) but no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the risk is confined to WordPress sites with this specific plugin installed.
Unauthenticated remote attackers can access backup data from WordPress sites running the WXD Backup Lite plugin versions 1.0.2 and earlier due to a missing authorization check (CWE-862). The flaw carries a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact only, and exploitation requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low-complexity nature and unauthenticated access make it a significant risk for affected sites.
Unauthenticated sensitive data exposure in SafeSnap - Verified WordPress Backup & Restore 2.1.2 and earlier allows remote attackers to retrieve confidential information from affected WordPress sites. The flaw, tracked as CVE-2026-41559 and categorized as CWE-201 (insertion of sensitive information into sent data), has a CVSS base score of 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact without requiring authentication or user interaction. No public exploit code or active exploitation was identified at time of analysis, but the low complexity and network reachability make timely patching important.
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.