WordPress
Monthly
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Unauthenticated broken access control in the WordPress plugin Advanced Posts Listing - Show Post List Easily (versions 1.0.8 and earlier) lets remote attackers retrieve protected post or listing data without logging in or triggering any user interaction. With a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-862 missing authorization, the flaw is a confidentiality-only issue: it exposes data but does not allow modification or denial of service. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the primary limiting factor is deployment-only sites running this specific, low-footprint plugin are affected.
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.
Broken authentication in the Simple JWT Login WordPress plugin 4.0.0 allows a remote authenticated attacker with subscriber-level privileges to bypass intended JWT authentication controls, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8, CWE-288). The vulnerability is network-exploitable, requires low complexity, and needs no user interaction, but an attacker must first obtain a low-privileged account-often self-registerable when open registration is enabled. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the WordPress plugin Simple File List (versions through 6.3.11) lets remote attackers remove files from a vulnerable site without authenticating, without user interaction, and without any non-default configuration. The issue is rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H), with the limited integrity sub-score reflecting that the real damage depends on which files the web server user can delete - deleting wp-config.php or core files is far more severe than deleting an uploaded asset. No public exploit identified at time of analysis and the plugin is not listed in CISA KEV; this is nonetheless a genuine high-priority issue for WordPress sites running the affected plugin.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.
Unauthenticated cross-site scripting in the nicdark Hotel Booking WordPress plugin affects all versions up to and including 3.8, allowing a remote attacker to inject script that executes in a victim's browser within the vulnerable site's origin. Exploitation is network-reachable and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is not automatic: per the assessed vector the attack depends on user interaction (UI:R), meaning a victim has to open a crafted link or page for the payload to fire. The assessed impact is browser-scoped (C:L/I:L/A:N with S:C), making this a moderate-risk XSS issue rather than an emergency; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated cross-site scripting in the Document Gallery WordPress plugin (versions 5.1.1 and earlier) allows remote attackers to inject script that executes in the browser of any user who opens a crafted link or views attacker-influenced gallery content, consistent with an assessed CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No authentication is required (PR:N) and no server-side privileges are needed, but exploitation depends on victim interaction (UI:R), which limits reliable mass exploitation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the issue was reported by Patchstack and affects any WordPress site running the vulnerable plugin.
Reflected cross-site scripting in the Youzify WordPress plugin (versions through 1.3.7) lets unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is lured into following a crafted link, carrying a CVSS 3.1 base score of 7.1. No authentication is required of the attacker (PR:N), but successful exploitation depends on victim interaction with an attacker-supplied URL (UI:R), and the script executes with changed scope (S:C) producing low confidentiality, integrity, and availability impact confined to the victim's browser session rather than the server. No public exploit code was identified and the vulnerability is not listed in CISA KEV, so exploitation status is assessed as no public exploit identified at time of analysis.
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.
Remote code execution (RCE) in WPShopmart Tabs Responsive plugin for WordPress (versions <= 2.5) allows an authenticated attacker with Editor-level privileges to execute arbitrary code on the server. This high-severity vulnerability (CVSS 8.0, CWE-94) requires high-complexity conditions (AC:H) and no user interaction (UI:N). No public exploit code has been identified at time of analysis; risk is concentrated on multi-user sites where untrusted users have elevated editing roles.
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.
Privilege escalation in the WordPress plugin Tourfic Pro (the paid extension of the Tourfic travel and hotel booking plugin) at version 1.17.3 and earlier allows an attacker to elevate to a higher-privileged WordPress role, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting full loss of confidentiality, integrity and availability within the affected site. The CVSS vector's PR:L indicates the attacker must first hold a low-privilege authenticated account (for example a self-registered subscriber) and that no user interaction is required, but the vendor's own description labels the flaw 'Unauthenticated' - a material conflict that determines whether only registered users or any site visitor can trigger it, and defenders should verify which precondition actually applies. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the plugin's comparatively small installed base further limits real-world exposure, so this is best treated as a credible priority for sites running the plugin rather than a broadly exploited campaign.
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Cross-site scripting in the ARForms WordPress plugin versions up to and including 7.1.2 allows unauthenticated remote attackers to inject script through plugin-handled form input that is rendered without proper output encoding (CVSS 7.1, CWE-79). Exploitation is not zero-click: per the CVSS vector UI:R, a victim must load or view the affected page, and meaningful impact typically depends on the victim being an authenticated user or administrator whose session can be abused. No public exploit code or confirmed active exploitation is identified in the provided data, and the Patchstack advisory is the primary disclosure source.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Radius Booking - Booking Calendar for Appointments & Services through 1.0.19 allows remote attackers to read arbitrary database data through crafted input, with the independent assessment limiting confirmed impact to confidentiality (C:H/I:N/A:N). Affected sites are only those with this specific plugin installed and active at a vulnerable version; no authentication, user interaction, or non-default configuration is required. No public exploit or CISA KEV entry is identified at time of analysis, and deployment scope is the primary limiting factor.
Unauthenticated privilege escalation in Meta Box AIO versions 3.7.1 and earlier allows remote attackers to gain elevated privileges on WordPress sites where the plugin is installed and active. With a CVSS score of 9.8 (Critical) and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication or user interaction and can be exploited over the network. No public exploit code has been identified at the time of analysis, but the vulnerability is rated critical due to its potential for full site compromise.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated cross-site scripting in the WordPress plugin Database for CF7 (vendor code4life) affects all versions up to and including 1.2.6, letting an attacker plant script that executes in the browser of a user - most likely an administrator reviewing stored Contact Form 7 submission data in the plugin's interface. Exploitation is remote and needs no attacker credentials (PR:N), but it does require victim interaction (UI:R) because the payload only fires when the affected page or submission view is rendered; the scope change (S:C) with limited confidentiality, integrity, and availability impact yields a CVSS 3.1 base score of 7.1. No public exploit code was identified and the flaw is not listed in CISA KEV at the time of analysis.
Missing authorization in the Wise Chat WordPress plugin (versions 3.4.1 and earlier) lets an authenticated low-privilege user - a Subscriber or any higher role - invoke functionality that lacks a capability check, allowing limited data modification and a significant availability impact on the affected site. The flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), meaning exploitation needs a valid low-privilege account (PR:L) but no victim interaction, so sites that allow open Subscriber self-registration are the realistic attack surface; sites with registration disabled and no untrusted low-privilege users are far less exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the low attack complexity and broad WordPress install base make timely patching advisable. The vulnerability was reported through Patchstack by security researcher Marcin.
Sensitive data exposure in the Edwiser Bridge WordPress plugin, affecting versions up to and including 4.3.4, allows remote attackers to read information the plugin transmits without any authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The weakness is classified as CWE-201, information exposure through sent data, meaning the plugin emits sensitive values outward rather than verifying that the requester is entitled to them; the assessed impact is loss of confidentiality only, with no integrity or availability effect, and the exact leaking feature or endpoint is not enumerated in the available advisory. This is a moderate-priority issue rather than an urgent one: no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the plugin's narrow, education-sector install base (WordPress sites integrated with Moodle) limits realistic exposure.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated cross-site scripting (XSS) in the Lumise Product Designer WordPress plugin, versions 2.1.1 and earlier, allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The vulnerability requires user interaction (e.g., clicking a crafted link) to execute, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High). No public exploit code or active exploitation has been identified at the time of analysis; authentication is not required to craft the payload, but victim interaction is needed for execution.
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Unauthenticated cross-site scripting in the Mapster WP Maps WordPress plugin through version 2.0.4 lets remote attackers inject script into pages or URLs that render unsanitized map input, executing in a victim's browser when they interact with the crafted content. No authentication is required for injection (CVSS PR:N), but exploitation depends on user interaction (UI:R), and the reported CVSS 3.1 base score is 7.1; the primary risk is session or token theft, forged actions, or UI manipulation in the victim's browser rather than direct server takeover. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Authenticated Subscriber-level attackers can exploit missing authorization checks in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090 to perform actions that may alter store integrity or cause a high availability impact. The flaw requires only a low-privileged account, which is readily available on sites with open registration, but confidentiality is not affected. No public exploit code has been identified, and the vulnerability is not known to be actively exploited.
Unauthenticated cross-site scripting (CWE-79) in the N-Media Frontend File Manager WordPress plugin affects all versions up to and including 23.6, allowing remote attackers to inject arbitrary script that executes in the browser of any user who renders the crafted content. Because the plugin is designed to expose file upload and management functionality to the site frontend, the vulnerable input path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), but a victim - typically a logged-in administrator or moderator - must interact with the attacker-supplied link or page for the scope-changing impact to materialize. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so current risk is driven by the large installed base of a frontend-facing plugin rather than confirmed active exploitation.
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
Unauthenticated cross-site scripting in the Smart Forms WordPress plugin (all versions up to and including 2.6.104) allows a remote attacker to have injected JavaScript execute in the browser of a user who interacts with attacker-controlled input - typically by opening a crafted link or viewing a page that reflects or stores the unsanitized value. The attacker needs no credentials (PR:N), but the payload only fires on the victim's side (UI:R), and the most serious outcomes depend on that victim being a logged-in or administrative user; CVSS 3.1 scores this 7.1, with the scope change (S:C) reflecting that script runs in the context of the victim's browsing session. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency, and patch status is not confirmed from the available data.
Unauthenticated cross-site scripting in WP User Frontend Pro 4.2.13 and earlier allows remote attackers to inject arbitrary script into a victim's browser via a crafted link, requiring the victim to click a link or visit an attacker-controlled page. The vulnerability is unauthenticated (PR:N) but requires user interaction (UI:R), and impact is confined to the browser context of the interacting user. No public exploit code or active exploitation is identified at time of analysis; no EPSS or KEV data was provided.
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.
Unauthenticated cross-site scripting in JoomUnited WP Media Folder through version 6.2.2 allows remote attackers to inject JavaScript that executes in a victim's browser when the victim interacts with a crafted page or request. The CVSS v3.1 score is 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, no authentication required, required user interaction, and limited confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is assessed as a moderate-priority web vulnerability rather than a top-tier emergency.
Remote code execution in WooCommerce Designer Pro (versions up to 1.9.33) allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The flaw is a code injection (CWE-94) with a CVSS score of 9.9 (Critical), requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability (scope change). Exploitation is most realistic on WooCommerce storefronts that permit open customer self-registration; no public exploit identified at time of analysis. The independent assessment confirms this is a genuine high-priority issue rather than a theoretical risk.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.
Remote code execution in the ACPT (Premium) WordPress plugin affects all versions up to and including 2.0.66, allowing an authenticated attacker with only subscriber-level access to run arbitrary code on the server. The chain works by abusing a REST API form-creation endpoint that performs no capability check, planting a malicious email_settings payload, and then triggering a form submission so the plugin's unsandboxed Twig environment renders attacker-controlled template expressions during email generation. No user interaction is required and no public exploit code has been identified at time of analysis, though the low authentication bar (subscriber) makes it considerably more dangerous on sites with open registration; exploitation is not confirmed actively exploited (no CISA KEV listing), and the vendor changelog points to a fixed release.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated sensitive data exposure in the Sitemovr WordPress plugin versions 1.0.1 and earlier allows remote attackers to retrieve undisclosed sensitive information from affected sites without authentication, user interaction, or non-default configuration, per the CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is limited mainly by deployment: only WordPress sites that use this obscure plugin and have not updated past 1.0.1 are exposed, and the Patchstack advisory does not specify exactly which data or endpoint leaks. No public exploit code was identified at time of analysis, and the independent assessment rates the available signals as consistent but thin.
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.
Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.
Unauthenticated reflected cross-site scripting (XSS) in the WordPress plugin Real 3D FlipBook versions 5.5 and earlier allows remote attackers to inject arbitrary script into a victim's browser session via a crafted link, requiring user interaction (UI:R) such as clicking the link. No authentication is required (PR:N), and the flaw is network-reachable (AV:N) with low complexity (AC:L), but impact is limited to the victim's browser context with no server-side compromise. Our independent assessment adjusts the availability impact to none (A:N), yielding a CVSS 3.1 base score of 6.1 rather than the vendor's 7.1; no public exploit code or active exploitation is identified at time of analysis.
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
PHP object injection in the WP Spell Check WordPress plugin, affecting all versions up to and including 12.1, allows an attacker who already holds administrator-level privileges to pass attacker-controlled data into PHP's deserialization routine and instantiate arbitrary objects. Successful object injection can lead to high-integrity and high-confidentiality impact - including code execution, file manipulation, or privilege abuse - depending on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress environment, which the available data does not confirm. With a CVSS 3.1 base score of 7.2 (High) and PR:H in the vector, the practical attack surface is limited to trusted high-privilege users; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
PHP object injection in the VK Google Job Posting Manager WordPress plugin (versions through 1.3.1) allows an authenticated low-privilege user to submit crafted serialized input that the plugin deserializes without validation, permitting object injection that can escalate to arbitrary code execution, file manipulation, or sensitive data exposure where a usable gadget chain exists in the plugin or its loaded libraries. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), the flaw is network-reachable with low complexity, requires only low-level authentication, and needs no user interaction, resulting in high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliability of full code execution depends on an unconfirmed PHP POP gadget chain, so successful exploitation is most plausible against sites where subscribers or other low-privilege accounts can be created or reached.
PHP object injection in the WordPress plugin Simple Event Planner (PressTigers) through version 1.5.7 lets an authenticated low-privileged user pass crafted serialized data to a plugin endpoint that is deserialized without validation, potentially leading to arbitrary object instantiation and, if a usable gadget chain exists in the plugin or surrounding WordPress codebase, to full remote code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privilege session - it is not exploitable unauthenticated - with no public exploit identified at time of analysis. Sites that permit open subscriber registration are the most exposed, since any registered user can reach the vulnerable code path.
PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions through 3.7.1) allows an attacker who already holds a high-privilege authenticated WordPress account to submit crafted serialized data to a plugin endpoint, potentially achieving object injection with high confidentiality, integrity and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) rates this 7.2 and confirms the attacker must be authenticated with elevated privileges (PR:H), which excludes anonymous internet users and is the primary limiting factor; no user interaction is required. No public exploit code has been identified at time of analysis, and there is no confirmed evidence of active exploitation (not listed in CISA KEV) - realistic impact depends on a usable PHP gadget chain being present in the plugin or the hosting stack, which is not confirmed by the available data.
PHP object injection in the WordPress plugin WP Ultimate Exporter (Smackcoders Inc.) affects all versions up to and including 3.0, allowing an attacker who already holds a high-privilege authenticated account on the target site to submit crafted serialized PHP data to a plugin endpoint and instantiate arbitrary objects. Successful exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or a loaded library; without one, the flaw may only yield object injection rather than full code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the principal barrier is the CVSS PR:H prerequisite, which limits realistic abuse to privileged insiders or attackers who have already compromised an administrative account.
Authenticated attackers with high privileges can exploit a PHP Object Injection vulnerability in Product Feed PRO for WooCommerce (versions up to 13.5.7) to potentially execute arbitrary code, delete files, or perform other malicious actions. The flaw stems from deserialization of untrusted data (CWE-502), and successful exploitation hinges on the presence of a reachable POP gadget chain in the targeted site's code; without such a chain, impact may be limited. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score is 7.2 (High).
Missing authorization checks in the WordPress plugin 'Scratch & Win - Giveaways and Contests' (all versions through 3.0.2, vendor Apps Mav) allow an authenticated low-privilege user - for example a subscriber on a site that permits open or self-service registration - to reach plugin functionality that should be gated behind higher-privilege capabilities, resulting in high confidentiality exposure plus limited integrity and availability impact (CVSS 3.1 base 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Exploitation is network-reachable and requires no user interaction, but it is constrained by the need for a valid low-privileged account, so purely anonymous abuse is not confirmed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released fixed version appears in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.
Authenticated low-privilege users can retrieve embedded sensitive data from WordPress sites running the RepairBuddy plugin (versions through 4.1226) due to a missing authorization check. This moderate-severity vulnerability (CVSS 7.1) impacts only confidentiality, requires a valid account with minimal privileges, and has no public exploit code or active exploitation reported.
Unauthenticated information disclosure in Five Star Restaurant Reservations (plugin versions through 2.7.24) allows remote attackers to extract embedded sensitive data from WordPress sites. The vulnerability, tracked as CWE-201, has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability impact. No public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data.
Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.
Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The reporting source scored this 7.6, whereas independent assessment rates it lower (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, ~4.9) because the injection is blind, read-only in effect, and gated behind admin-level access - a genuine but conditional risk rather than a drop-everything emergency.
Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows remote attackers to force a logged-in user, typically an administrator, to perform unintended actions by tricking them into interacting with a crafted link or malicious page, due to missing CSRF token validation. Exploitation requires user interaction (UI:R) and an active authenticated session, but no public exploit code is currently identified. The vulnerability has a CVSS score of 7.1 (moderate severity per independent assessment) and is tracked as CWE-352.
Unauthenticated information disclosure in the StylemixThemes Cost Calculator Builder WordPress plugin (all versions through 4.0.17) lets remote attackers retrieve sensitive data that the plugin embeds in the responses it sends to clients. The independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, unauthenticated and requiring no user interaction, with confidentiality impact limited to Low - which is lower than the 7.5 feed-reported score and should be treated as the authoritative view. No public exploit code exists and no confirmed active exploitation has been observed (no public exploit identified at time of analysis), and the available data identifies no fixed version, so the only prerequisite is that the vulnerable plugin be installed and active at 4.0.17 or earlier.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Stored cross-site scripting in the Cozmoslabs TranslatePress WordPress plugin (versions up to and including 3.3.6) lets an attacker persist malicious script through a TranslatePress input field that is not neutralized when the translated page is generated, so the payload executes in the browser of any user who later views that rendered page. Exploitation is constrained by the required victim interaction (UI:R) and by the fact that the specific injection point and the role needed to store the payload are not identified in the available data; Patchstack scores it CVSS 7.1 with PR:N, while our independent assessment uses PR:L, reflecting that persistence typically requires at least low-privileged authenticated access such as a translator or editor account. Impact is limited to Low confidentiality, integrity, and availability with a scope change, and no public exploit identified at time of analysis.
Reflected cross-site scripting in VeronaLabs WP Statistics through 14.16.14 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim clicks a crafted link. Exploitation requires user interaction and runs in the victim's session context, so impact is greatest when an authenticated administrator is lured into triggering the payload; there is no public exploit identified at time of analysis. The independent assessment rates confidentiality and integrity impact as low and availability impact as none, with scope change, consistent with a social-engineering-gated reflected XSS flaw rather than silent remote compromise.
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Unauthenticated broken access control in the WordPress plugin Advanced Posts Listing - Show Post List Easily (versions 1.0.8 and earlier) lets remote attackers retrieve protected post or listing data without logging in or triggering any user interaction. With a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-862 missing authorization, the flaw is a confidentiality-only issue: it exposes data but does not allow modification or denial of service. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the primary limiting factor is deployment-only sites running this specific, low-footprint plugin are affected.
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated information disclosure in the WooCommerce Multivendor Marketplace - REST API plugin (versions up to 1.6.3) allows remote attackers to bypass access controls and read sensitive data from affected WordPress sites. The vulnerability has a CVSS score of 7.5 (CWE-862, missing authorization) and requires no authentication or user interaction. No public exploit code has been identified at time of analysis, and the overall risk is assessed as a credible but moderate-priority issue due to its confidentiality-only impact and the need for the specific plugin to be installed.
Broken authentication in the Simple JWT Login WordPress plugin 4.0.0 allows a remote authenticated attacker with subscriber-level privileges to bypass intended JWT authentication controls, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8, CWE-288). The vulnerability is network-exploitable, requires low complexity, and needs no user interaction, but an attacker must first obtain a low-privileged account-often self-registerable when open registration is enabled. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the WordPress plugin Simple File List (versions through 6.3.11) lets remote attackers remove files from a vulnerable site without authenticating, without user interaction, and without any non-default configuration. The issue is rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H), with the limited integrity sub-score reflecting that the real damage depends on which files the web server user can delete - deleting wp-config.php or core files is far more severe than deleting an uploaded asset. No public exploit identified at time of analysis and the plugin is not listed in CISA KEV; this is nonetheless a genuine high-priority issue for WordPress sites running the affected plugin.
VikRentCar WordPress plugin versions up to 1.4.6 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability (CWE-79) that allows remote attackers to inject arbitrary script into a victim's browser session. Exploitation requires the victim to click a crafted link or visit a malicious page (CVSS UI:R), but no authentication is needed (PR:N). With a CVSS score of 7.1, this moderate-severity flaw could lead to session hijacking or defacement limited to the site context; no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.
Unauthenticated cross-site scripting in the nicdark Hotel Booking WordPress plugin affects all versions up to and including 3.8, allowing a remote attacker to inject script that executes in a victim's browser within the vulnerable site's origin. Exploitation is network-reachable and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is not automatic: per the assessed vector the attack depends on user interaction (UI:R), meaning a victim has to open a crafted link or page for the payload to fire. The assessed impact is browser-scoped (C:L/I:L/A:N with S:C), making this a moderate-risk XSS issue rather than an emergency; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated cross-site scripting in the Document Gallery WordPress plugin (versions 5.1.1 and earlier) allows remote attackers to inject script that executes in the browser of any user who opens a crafted link or views attacker-influenced gallery content, consistent with an assessed CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No authentication is required (PR:N) and no server-side privileges are needed, but exploitation depends on victim interaction (UI:R), which limits reliable mass exploitation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the issue was reported by Patchstack and affects any WordPress site running the vulnerable plugin.
Reflected cross-site scripting in the Youzify WordPress plugin (versions through 1.3.7) lets unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is lured into following a crafted link, carrying a CVSS 3.1 base score of 7.1. No authentication is required of the attacker (PR:N), but successful exploitation depends on victim interaction with an attacker-supplied URL (UI:R), and the script executes with changed scope (S:C) producing low confidentiality, integrity, and availability impact confined to the victim's browser session rather than the server. No public exploit code was identified and the vulnerability is not listed in CISA KEV, so exploitation status is assessed as no public exploit identified at time of analysis.
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.
Remote code execution (RCE) in WPShopmart Tabs Responsive plugin for WordPress (versions <= 2.5) allows an authenticated attacker with Editor-level privileges to execute arbitrary code on the server. This high-severity vulnerability (CVSS 8.0, CWE-94) requires high-complexity conditions (AC:H) and no user interaction (UI:N). No public exploit code has been identified at time of analysis; risk is concentrated on multi-user sites where untrusted users have elevated editing roles.
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.
Privilege escalation in the WordPress plugin Tourfic Pro (the paid extension of the Tourfic travel and hotel booking plugin) at version 1.17.3 and earlier allows an attacker to elevate to a higher-privileged WordPress role, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting full loss of confidentiality, integrity and availability within the affected site. The CVSS vector's PR:L indicates the attacker must first hold a low-privilege authenticated account (for example a self-registered subscriber) and that no user interaction is required, but the vendor's own description labels the flaw 'Unauthenticated' - a material conflict that determines whether only registered users or any site visitor can trigger it, and defenders should verify which precondition actually applies. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the plugin's comparatively small installed base further limits real-world exposure, so this is best treated as a credible priority for sites running the plugin rather than a broadly exploited campaign.
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Unauthenticated broken authentication in the Graphina - Elementor Charts and Graphs WordPress plugin affects versions 3.1.12 and earlier, allowing network-reachable attackers to reach functionality that should require authentication and, per the assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), to obtain high-impact confidential information without any credentials or user interaction. Because the vector carries PR:N, exploitation requires no authentication and no special conditions beyond the plugin being installed, active, and at a vulnerable version - in practice this means a site running Elementor with the affected Graphina release. Only confidentiality is impacted; there is no integrity or availability effect per the assessed vector, and no public exploit code or CISA KEV entry was identified in the available intelligence, so no public exploit is identified at time of analysis. The precise vulnerable feature or endpoint is not described in the supplied data and should be confirmed against the Patchstack advisory.
Cross-site scripting in the ARForms WordPress plugin versions up to and including 7.1.2 allows unauthenticated remote attackers to inject script through plugin-handled form input that is rendered without proper output encoding (CVSS 7.1, CWE-79). Exploitation is not zero-click: per the CVSS vector UI:R, a victim must load or view the affected page, and meaningful impact typically depends on the victim being an authenticated user or administrator whose session can be abused. No public exploit code or confirmed active exploitation is identified in the provided data, and the Patchstack advisory is the primary disclosure source.
Privilege escalation in the WebAppick Challan WordPress plugin (published as PDF Invoice for WooCommerce) version 3.7.88 and earlier allows an authenticated WooCommerce Shop Manager to obtain capabilities beyond the intended Shop Manager role, rated CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:H, only attackers who already hold valid Shop Manager credentials or control a Shop Manager session can reach the flaw; anonymous visitors and self-registered subscriber-level users cannot use it, and WooCommerce must be active on the site for that role to exist at all. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Radius Booking - Booking Calendar for Appointments & Services through 1.0.19 allows remote attackers to read arbitrary database data through crafted input, with the independent assessment limiting confirmed impact to confidentiality (C:H/I:N/A:N). Affected sites are only those with this specific plugin installed and active at a vulnerable version; no authentication, user interaction, or non-default configuration is required. No public exploit or CISA KEV entry is identified at time of analysis, and deployment scope is the primary limiting factor.
Unauthenticated privilege escalation in Meta Box AIO versions 3.7.1 and earlier allows remote attackers to gain elevated privileges on WordPress sites where the plugin is installed and active. With a CVSS score of 9.8 (Critical) and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication or user interaction and can be exploited over the network. No public exploit code has been identified at the time of analysis, but the vulnerability is rated critical due to its potential for full site compromise.
Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly.
Unauthenticated reflected cross-site scripting in Midtrans-WooCommerce versions up to and including 2.32.3 allows an attacker to execute arbitrary script in the browser of a victim who interacts with a crafted link or request while the plugin is active on a WordPress site. The flaw is rated CVSS 3.1 7.1 (CWE-79) and requires user interaction (UI:R), so automated wormable exploitation is limited; impact scales if a logged-in administrator is targeted, potentially enabling session theft or unauthorized actions in the site context. No public exploit identified at time of analysis and no CISA KEV entry indicates active exploitation; the vulnerable plugin must be installed and active for exploitation.
Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority.
WP Duplicate, a WordPress plugin maintained by Revmakx, fails to validate uploaded files in versions up to and including 1.1.11, letting a user holding only a Subscriber-level account push an arbitrary file (for example a PHP script) onto the server. The published CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N, with S:C in the vendor/registry vector while the independent assessment scores S:U with C:H/I:H/A:H); exploitation is remote, low-complexity and needs no user interaction, and the practical barrier is simply that the target site must allow the attacker to hold a Subscriber account, which self-service registration makes trivial. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so impact is potential rather than observed, but the low privilege requirement keeps the risk high for any site with open registration.
Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Missing authorization checks in the PayPlug for WooCommerce (Official) WordPress plugin at version 3.1.0 and earlier let unauthenticated remote attackers reach plugin functionality that should require privileged access, degrading site integrity (CVSS 3.1 base 7.5, HIGH). The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, and it affects WooCommerce stores running this PayPlug payment-gateway plugin within the vulnerable range; exploitation is constrained only by the need for the plugin to be installed and active. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this CVE, so broad opportunistic scanning rather than confirmed active exploitation is the realistic near-term concern.
Unauthenticated cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce (BOGO, Upsells, Direct Checkout, Quick View, Side Cart) through version 2.0.6 lets remote attackers get script executed in a victim's browser when that user follows a crafted link or loads attacker-influenced input on a WordPress/WooCommerce store running the plugin. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1) confirms no attacker authentication is needed but exploitation hinges on victim interaction, and the changed scope reflects that the payload runs in the affected store's origin rather than the attacker's. No public exploit code and no confirmed active exploitation are identified at time of analysis, so practical exposure is limited to sites where this WeDevs plugin is installed and active and the vulnerable parameter is reachable.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated cross-site scripting in the WordPress plugin Database for CF7 (vendor code4life) affects all versions up to and including 1.2.6, letting an attacker plant script that executes in the browser of a user - most likely an administrator reviewing stored Contact Form 7 submission data in the plugin's interface. Exploitation is remote and needs no attacker credentials (PR:N), but it does require victim interaction (UI:R) because the payload only fires when the affected page or submission view is rendered; the scope change (S:C) with limited confidentiality, integrity, and availability impact yields a CVSS 3.1 base score of 7.1. No public exploit code was identified and the flaw is not listed in CISA KEV at the time of analysis.
Missing authorization in the Wise Chat WordPress plugin (versions 3.4.1 and earlier) lets an authenticated low-privilege user - a Subscriber or any higher role - invoke functionality that lacks a capability check, allowing limited data modification and a significant availability impact on the affected site. The flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), meaning exploitation needs a valid low-privilege account (PR:L) but no victim interaction, so sites that allow open Subscriber self-registration are the realistic attack surface; sites with registration disabled and no untrusted low-privilege users are far less exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the low attack complexity and broad WordPress install base make timely patching advisable. The vulnerability was reported through Patchstack by security researcher Marcin.
Sensitive data exposure in the Edwiser Bridge WordPress plugin, affecting versions up to and including 4.3.4, allows remote attackers to read information the plugin transmits without any authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The weakness is classified as CWE-201, information exposure through sent data, meaning the plugin emits sensitive values outward rather than verifying that the requester is entitled to them; the assessed impact is loss of confidentiality only, with no integrity or availability effect, and the exact leaking feature or endpoint is not enumerated in the available advisory. This is a moderate-priority issue rather than an urgent one: no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the plugin's narrow, education-sector install base (WordPress sites integrated with Moodle) limits realistic exposure.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated cross-site scripting (XSS) in the Lumise Product Designer WordPress plugin, versions 2.1.1 and earlier, allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The vulnerability requires user interaction (e.g., clicking a crafted link) to execute, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High). No public exploit code or active exploitation has been identified at the time of analysis; authentication is not required to craft the payload, but victim interaction is needed for execution.
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Unauthenticated cross-site scripting in the Mapster WP Maps WordPress plugin through version 2.0.4 lets remote attackers inject script into pages or URLs that render unsanitized map input, executing in a victim's browser when they interact with the crafted content. No authentication is required for injection (CVSS PR:N), but exploitation depends on user interaction (UI:R), and the reported CVSS 3.1 base score is 7.1; the primary risk is session or token theft, forged actions, or UI manipulation in the victim's browser rather than direct server takeover. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated arbitrary file upload in Kognetiks Chatbot for WordPress 2.4.9 and earlier allows remote attackers to upload files to the WordPress site without authentication, potentially leading to code execution if the uploaded file is placed in a web-executable location. The independent assessment confirms a high-priority, genuine vulnerability with remote unauthenticated exploitation, no user interaction, and only the vulnerable plugin being installed and active as a prerequisite. No CISA KEV entry or public exploit code is identified in the provided data, and EPSS is not provided.
Authenticated Subscriber-level attackers can exploit missing authorization checks in ECPay Ecommerce for WooCommerce versions up to 1.1.2606090 to perform actions that may alter store integrity or cause a high availability impact. The flaw requires only a low-privileged account, which is readily available on sites with open registration, but confidentiality is not affected. No public exploit code has been identified, and the vulnerability is not known to be actively exploited.
Unauthenticated cross-site scripting (CWE-79) in the N-Media Frontend File Manager WordPress plugin affects all versions up to and including 23.6, allowing remote attackers to inject arbitrary script that executes in the browser of any user who renders the crafted content. Because the plugin is designed to expose file upload and management functionality to the site frontend, the vulnerable input path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1), but a victim - typically a logged-in administrator or moderator - must interact with the attacker-supplied link or page for the scope-changing impact to materialize. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so current risk is driven by the large installed base of a frontend-facing plugin rather than confirmed active exploitation.
Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). The provided vector scores 7.1 (High), while the independent assessment applies no availability impact (A:N); no public exploit identified at time of analysis and no CISA KEV confirmation is present.
Unauthenticated cross-site scripting in the Smart Forms WordPress plugin (all versions up to and including 2.6.104) allows a remote attacker to have injected JavaScript execute in the browser of a user who interacts with attacker-controlled input - typically by opening a crafted link or viewing a page that reflects or stores the unsanitized value. The attacker needs no credentials (PR:N), but the payload only fires on the victim's side (UI:R), and the most serious outcomes depend on that victim being a logged-in or administrative user; CVSS 3.1 scores this 7.1, with the scope change (S:C) reflecting that script runs in the context of the victim's browsing session. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency, and patch status is not confirmed from the available data.
Unauthenticated cross-site scripting in WP User Frontend Pro 4.2.13 and earlier allows remote attackers to inject arbitrary script into a victim's browser via a crafted link, requiring the victim to click a link or visit an attacker-controlled page. The vulnerability is unauthenticated (PR:N) but requires user interaction (UI:R), and impact is confined to the browser context of the interacting user. No public exploit code or active exploitation is identified at time of analysis; no EPSS or KEV data was provided.
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.
Unauthenticated cross-site scripting in JoomUnited WP Media Folder through version 6.2.2 allows remote attackers to inject JavaScript that executes in a victim's browser when the victim interacts with a crafted page or request. The CVSS v3.1 score is 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, no authentication required, required user interaction, and limited confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is assessed as a moderate-priority web vulnerability rather than a top-tier emergency.
Remote code execution in WooCommerce Designer Pro (versions up to 1.9.33) allows authenticated attackers with Subscriber-level access or higher to execute arbitrary code on the server. The flaw is a code injection (CWE-94) with a CVSS score of 9.9 (Critical), requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability (scope change). Exploitation is most realistic on WooCommerce storefronts that permit open customer self-registration; no public exploit identified at time of analysis. The independent assessment confirms this is a genuine high-priority issue rather than a theoretical risk.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.
Remote code execution in the ACPT (Premium) WordPress plugin affects all versions up to and including 2.0.66, allowing an authenticated attacker with only subscriber-level access to run arbitrary code on the server. The chain works by abusing a REST API form-creation endpoint that performs no capability check, planting a malicious email_settings payload, and then triggering a form submission so the plugin's unsandboxed Twig environment renders attacker-controlled template expressions during email generation. No user interaction is required and no public exploit code has been identified at time of analysis, though the low authentication bar (subscriber) makes it considerably more dangerous on sites with open registration; exploitation is not confirmed actively exploited (no CISA KEV listing), and the vendor changelog points to a fixed release.
Stored cross-site scripting in the WordPress plugin Post SMTP (Complete Email Deliverability and SMTP Solution) affects all versions up to and including 4.0.1, allowing an unauthenticated attacker to persist arbitrary script content through the 'user_email' parameter. Exploitation is conditional: it requires a WordPress Multisite installation with public user registration enabled, where WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, causing the send to fail and the raw attacker-controlled address to be written verbatim into the email log via the failed-send exception message; the payload then executes when an administrator views the affected email-log page. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterized as conditional rather than broadly urgent because the prerequisite Multisite-plus-open-registration configuration is non-default and the payload is inert until an admin opens the log view. Upgrading to 4.0.2 remediates the issue.
Unauthenticated sensitive data exposure in the Sitemovr WordPress plugin versions 1.0.1 and earlier allows remote attackers to retrieve undisclosed sensitive information from affected sites without authentication, user interaction, or non-default configuration, per the CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is limited mainly by deployment: only WordPress sites that use this obscure plugin and have not updated past 1.0.1 are exposed, and the Patchstack advisory does not specify exactly which data or endpoint leaks. No public exploit code was identified at time of analysis, and the independent assessment rates the available signals as consistent but thin.
Authentication bypass in WP Synchro (WP Migration Plugin DB & Files) through version 1.16.1 lets a low-privilege subscriber-level account defeat the plugin's two-factor authentication enforcement, resulting in high confidentiality, integrity, and availability impact on the affected WordPress site. The flaw is network-reachable but requires an existing authenticated account (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and carries high attack complexity, so it is not exploitable by a fully unauthenticated attacker and in practice favors sites that permit open user registration. No public exploit code was identified at time of analysis, and this is assessed as a moderate-priority issue rather than an urgent one.
Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.
Unauthenticated reflected cross-site scripting (XSS) in the WordPress plugin Real 3D FlipBook versions 5.5 and earlier allows remote attackers to inject arbitrary script into a victim's browser session via a crafted link, requiring user interaction (UI:R) such as clicking the link. No authentication is required (PR:N), and the flaw is network-reachable (AV:N) with low complexity (AC:L), but impact is limited to the victim's browser context with no server-side compromise. Our independent assessment adjusts the availability impact to none (A:N), yielding a CVSS 3.1 base score of 6.1 rather than the vendor's 7.1; no public exploit code or active exploitation is identified at time of analysis.
Unauthenticated broken access control in Morning for WooCommerce (plugin slug wc-gateway-greeninvoice) 2.4.1 and earlier allows remote attackers to reach plugin functionality that should require authorization, undermining the integrity of the store's invoicing/gateway data. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) confirms the flaw is network-reachable with no credentials and no user interaction, while bounding impact to integrity alone - no confidentiality or availability effect is assessed. Exposure is confined to WooCommerce stores that specifically deploy this Green Invoice/Morning gateway plugin; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in FluentBooking Pro versions prior to 2.5.0 allows remote attackers to bypass authorization checks and modify booking-related data or functionality, as scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high integrity impact but no confidentiality or availability impact. The flaw requires no authentication and no user interaction, and can be exploited against any internet-reachable WordPress site running the vulnerable paid plugin. No public exploit code was identified at time of analysis, and a vendor patch is available in version 2.5.0.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
PHP object injection in the WP Spell Check WordPress plugin, affecting all versions up to and including 12.1, allows an attacker who already holds administrator-level privileges to pass attacker-controlled data into PHP's deserialization routine and instantiate arbitrary objects. Successful object injection can lead to high-integrity and high-confidentiality impact - including code execution, file manipulation, or privilege abuse - depending on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress environment, which the available data does not confirm. With a CVSS 3.1 base score of 7.2 (High) and PR:H in the vector, the practical attack surface is limited to trusted high-privilege users; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
PHP object injection in the VK Google Job Posting Manager WordPress plugin (versions through 1.3.1) allows an authenticated low-privilege user to submit crafted serialized input that the plugin deserializes without validation, permitting object injection that can escalate to arbitrary code execution, file manipulation, or sensitive data exposure where a usable gadget chain exists in the plugin or its loaded libraries. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), the flaw is network-reachable with low complexity, requires only low-level authentication, and needs no user interaction, resulting in high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliability of full code execution depends on an unconfirmed PHP POP gadget chain, so successful exploitation is most plausible against sites where subscribers or other low-privilege accounts can be created or reached.
PHP object injection in the WordPress plugin Simple Event Planner (PressTigers) through version 1.5.7 lets an authenticated low-privileged user pass crafted serialized data to a plugin endpoint that is deserialized without validation, potentially leading to arbitrary object instantiation and, if a usable gadget chain exists in the plugin or surrounding WordPress codebase, to full remote code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privilege session - it is not exploitable unauthenticated - with no public exploit identified at time of analysis. Sites that permit open subscriber registration are the most exposed, since any registered user can reach the vulnerable code path.
PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions through 3.7.1) allows an attacker who already holds a high-privilege authenticated WordPress account to submit crafted serialized data to a plugin endpoint, potentially achieving object injection with high confidentiality, integrity and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) rates this 7.2 and confirms the attacker must be authenticated with elevated privileges (PR:H), which excludes anonymous internet users and is the primary limiting factor; no user interaction is required. No public exploit code has been identified at time of analysis, and there is no confirmed evidence of active exploitation (not listed in CISA KEV) - realistic impact depends on a usable PHP gadget chain being present in the plugin or the hosting stack, which is not confirmed by the available data.
PHP object injection in the WordPress plugin WP Ultimate Exporter (Smackcoders Inc.) affects all versions up to and including 3.0, allowing an attacker who already holds a high-privilege authenticated account on the target site to submit crafted serialized PHP data to a plugin endpoint and instantiate arbitrary objects. Successful exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or a loaded library; without one, the flaw may only yield object injection rather than full code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the principal barrier is the CVSS PR:H prerequisite, which limits realistic abuse to privileged insiders or attackers who have already compromised an administrative account.
Authenticated attackers with high privileges can exploit a PHP Object Injection vulnerability in Product Feed PRO for WooCommerce (versions up to 13.5.7) to potentially execute arbitrary code, delete files, or perform other malicious actions. The flaw stems from deserialization of untrusted data (CWE-502), and successful exploitation hinges on the presence of a reachable POP gadget chain in the targeted site's code; without such a chain, impact may be limited. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score is 7.2 (High).
Missing authorization checks in the WordPress plugin 'Scratch & Win - Giveaways and Contests' (all versions through 3.0.2, vendor Apps Mav) allow an authenticated low-privilege user - for example a subscriber on a site that permits open or self-service registration - to reach plugin functionality that should be gated behind higher-privilege capabilities, resulting in high confidentiality exposure plus limited integrity and availability impact (CVSS 3.1 base 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). Exploitation is network-reachable and requires no user interaction, but it is constrained by the need for a valid low-privileged account, so purely anonymous abuse is not confirmed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released fixed version appears in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.
Authenticated low-privilege users can retrieve embedded sensitive data from WordPress sites running the RepairBuddy plugin (versions through 4.1226) due to a missing authorization check. This moderate-severity vulnerability (CVSS 7.1) impacts only confidentiality, requires a valid account with minimal privileges, and has no public exploit code or active exploitation reported.
Unauthenticated information disclosure in Five Star Restaurant Reservations (plugin versions through 2.7.24) allows remote attackers to extract embedded sensitive data from WordPress sites. The vulnerability, tracked as CWE-201, has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability impact. No public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data.
Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.
Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The reporting source scored this 7.6, whereas independent assessment rates it lower (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, ~4.9) because the injection is blind, read-only in effect, and gated behind admin-level access - a genuine but conditional risk rather than a drop-everything emergency.
Cross-Site Request Forgery (CSRF) in the Blubrry PowerPress Podcasting plugin for WordPress up to version 11.17.9 allows remote attackers to force a logged-in user, typically an administrator, to perform unintended actions by tricking them into interacting with a crafted link or malicious page, due to missing CSRF token validation. Exploitation requires user interaction (UI:R) and an active authenticated session, but no public exploit code is currently identified. The vulnerability has a CVSS score of 7.1 (moderate severity per independent assessment) and is tracked as CWE-352.
Unauthenticated information disclosure in the StylemixThemes Cost Calculator Builder WordPress plugin (all versions through 4.0.17) lets remote attackers retrieve sensitive data that the plugin embeds in the responses it sends to clients. The independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, unauthenticated and requiring no user interaction, with confidentiality impact limited to Low - which is lower than the 7.5 feed-reported score and should be treated as the authoritative view. No public exploit code exists and no confirmed active exploitation has been observed (no public exploit identified at time of analysis), and the available data identifies no fixed version, so the only prerequisite is that the vulnerable plugin be installed and active at 4.0.17 or earlier.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Stored cross-site scripting in the Cozmoslabs TranslatePress WordPress plugin (versions up to and including 3.3.6) lets an attacker persist malicious script through a TranslatePress input field that is not neutralized when the translated page is generated, so the payload executes in the browser of any user who later views that rendered page. Exploitation is constrained by the required victim interaction (UI:R) and by the fact that the specific injection point and the role needed to store the payload are not identified in the available data; Patchstack scores it CVSS 7.1 with PR:N, while our independent assessment uses PR:L, reflecting that persistence typically requires at least low-privileged authenticated access such as a translator or editor account. Impact is limited to Low confidentiality, integrity, and availability with a scope change, and no public exploit identified at time of analysis.
Reflected cross-site scripting in VeronaLabs WP Statistics through 14.16.14 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim clicks a crafted link. Exploitation requires user interaction and runs in the victim's session context, so impact is greatest when an authenticated administrator is lured into triggering the payload; there is no public exploit identified at time of analysis. The independent assessment rates confidentiality and integrity impact as low and availability impact as none, with scope change, consistent with a social-engineering-gated reflected XSS flaw rather than silent remote compromise.
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.