WordPress
Monthly
Unauthenticated stored cross-site scripting (XSS) in the WordPress plugin Business Essentials for Contact Form 7 (versions ≤1.2.1) allows remote attackers to inject arbitrary web scripts via the 'gateway' form field, which execute when a user views the injected page. Exploitation requires a non-default configuration-the plugin's Payments module must be enabled and a form must be set to accept both PayPal and Stripe as payment gateways-substantially narrowing the affected population. No public exploit code has been identified at time of analysis, and while the CVSS score is 7.2 (High), the specific prerequisites and limited browser-context impact (C:L/I:L, no availability impact) result in a low net real-world priority. A fix is available in plugin changeset 3713721 (versions after 1.2.1).
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.
Unauthenticated attackers can create WordPress administrator accounts on any site running the Super Forms - Drag & Drop Form Builder plugin up to and including version 6.3.316 whenever the Register & Login add-on is active and a registration form using register_login_action='register' is published, because the add-on accepts a client-supplied 'role' parameter and passes it straight into wp_insert_user(). With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the flaw yields full site takeover, but exposure is conditional: the required public registration form must exist, and sites using Super Forms only for contact or other non-registration forms are not affected. No public exploit code has been identified at time of analysis, and an upstream fix is available via GitHub pull request #205, though a released patched version is not independently confirmed in the available data.
Unauthenticated attackers can obtain full WordPress session cookies - including for a Network Super Admin - on any Multisite installation running the Ultimate Multisite (WaaS/SaaS) plugin through version 2.15.0. The flaw lies in the publicly reachable wu_ajax_nopriv_wu_validate_form AJAX handler: supplying checkout_form=wu-finish-checkout discards all validation rules and forces is_last_step() to true, routing the request straight into order processing, where the attacker-supplied email_address is resolved to an existing WordPress user ID without ownership verification and login_customer_after_checkout() issues a passwordless wp_set_auth_cookie() for that user. Exploitation requires only a freely obtainable checkout nonce and the victim's email address (remote, unauthenticated, no user interaction per the CVSS vector PR:N/UI:N), but it succeeds only against accounts that have no pre-existing Ultimate Multisite customer record - such as a Network Super Admin on a fresh Multisite install or any administrator/editor created before the plugin was configured. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the 9.8 score and authentication-bypass-to-admin impact make this a high-priority patch.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated disclosure of payment gateway API credentials affects WordPress sites running the Payments for Hubtel plugin at versions before 1.0.2, because the plugin writes raw payment requests - including the store's Hubtel API keys in plain text - into a debug log that is reachable over the public web. Any remote attacker who knows the log's location can read those credentials without authentication, user interaction, or privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, score 7.5), and because the path is fixed the retrieval is automatable, though CISA's SSVC assessment rates current exploitation as none and no public exploit has been identified at time of analysis; the practical prerequisite is that the site must have processed at least one payment so credentials were actually logged. Impact is confined to confidentiality (C:H with I:N/A:N) - the exposed keys could let an attacker interact with the merchant's Hubtel payment gateway - and the vendor has released a fix in 1.0.2.
Reflected cross-site scripting in the Five Star Restaurant Reviews WordPress plugin (all versions before 2.3.14) lets unauthenticated attackers inject arbitrary JavaScript into an HTML tag via a crafted request that a victim must be socially engineered into submitting, with the script then running in that victim's browser - including a logged-in administrator, where it executes with administrative privileges. The vendor has shipped version 2.3.14 to correct the missing output escaping (CWE-79); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor CVSS 3.1 vector (7.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reachability, low attack complexity, no required privileges, mandatory user interaction, and a scope change caused by script execution in the victim's browser rather than the plugin's own context; our assessment keeps the same vector but sets the availability impact to none (A:N).
Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.
Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.
Stored cross-site scripting in the Paytm Payment Gateway WordPress plugin (all versions before 2.8.9) allows unauthenticated attackers to inject script that later executes in a store administrator's browser session. The plugin fails to sanitize or escape payment callback data before rendering it on an admin page, and the callback integrity check can be forged whenever the gateway is enabled in a credential-less configuration, which is the core non-default prerequisite; exploitation is remote and unauthenticated (PR:N) but requires low attack complexity prerequisites plus user interaction, since a store administrator must subsequently open the affected admin page (UI:R). No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, and a vendor patch is available. Successful exploitation yields script execution in an administrator session, which can lead to full site compromise given the high confidentiality and integrity impact.
Unauthenticated arbitrary file and directory deletion in the Cache Enabler WordPress plugin (all versions before 1.8.17) is possible on sites where some other installed plugin, theme, or integration passes a request-derived URL into Cache Enabler's public cache-clearing hook - a non-default bridging precondition that explains the vendor's AC:H rating despite a CVSS 3.1 base score of 8.7. The purge routine never validates that URL before constructing a filesystem path and never confines the resulting delete operation to the cache directory, producing a scope change (S:C) with high integrity and availability impact while requiring no authentication or user interaction. Patch status: vendor-released patch: 1.8.17; exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated remote attackers can take over WordPress sites running the BackupSheep WordPress Backup Plugin through version 1.8 by supplying a blank or unset integration key that the plugin incorrectly treats as valid, allowing them to generate and download full-site backups containing the database with WordPress user password hashes and to delete arbitrary files on the server. The plugin was closed on WordPress.org in July 2024 and no fixed version exists, so exposure is limited to sites that still have this abandoned plugin installed and active; the defect is rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Cross-site request forgery in the Featured Image from URL (FIFU) WordPress plugin before 6.0.8 and the FIFU Premium plugin before 8.2.8 allows an unauthenticated attacker to make a logged-in administrator's browser execute arbitrary WordPress REST API actions, including creating a brand-new administrator account. The defect is in the plugin's REST API nonce enforcement: supplying a specially crafted URL causes the nonce check to be bypassed for the whole request, so with the victim's admin session active the REST call is accepted without a valid nonce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) the attacker needs no account on the target, but the administrator must be induced to visit an attacker-controlled page, making the attack social-engineering dependent; no public exploit code has been identified at time of analysis, and vendor patches are available.
Unauthenticated stored cross-site scripting in the Extendify plugin for WordPress (all versions up to and including 3.1.6) allows any remote attacker to plant arbitrary JavaScript into pages via the 'styles.blocks' Block Type Key, with no authentication or victim interaction required at injection time. The flaw exists because the plugin's registerIncoming() handler is bound to rest_request_before_callbacks and therefore executes before WordPress evaluates the target route's permission_callback, so a plain POST, PUT, or PATCH to a /wp/v2/global-styles endpoint reaches the vulnerable sanitization path on a default site with the REST API reachable. Impact is browser-side script execution when a victim later loads the injected page, not direct server compromise; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this CVE. Upgrading to version 3.2.0 removes the condition.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
Cross-site scripting in the Branda WordPress white-labeling plugin (versions up to and including 3.4.32) allows a low-privileged Subscriber-level account to plant JavaScript that then executes in the browser of a higher-privileged user, such as an administrator, who views the affected content - potentially enabling session or administrative actions in that victim's context. The flaw is tracked as CVE-2026-102376 (EUVD-2026-90222), reported by Patchstack, with a published CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our assessment revises the privilege requirement to PR:L because the 'Subscriber' attack path assumes at least an authenticated low-privileged account, while impact remains confined to the browser JavaScript context (low confidentiality, integrity and availability). No public exploit identified at time of analysis, and there is no CISA KEV entry confirming active exploitation.
PHP object injection in the WordPress plugin Nested Pages (wp-nested-pages, by Hook & Filter) in versions up to and including 3.3.2 lets an attacker who holds at least a Contributor-level account on the affected site submit crafted serialized data that is passed to PHP's unserialization logic, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, to code execution, data theft, or full site compromise. The reported base score of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vendor's own 'Contributor PHP Object Injection' designation; the authoritative assessment re-scores the issue as AV:N/AC:H/PR:L/UI:N, reflecting that a low-privileged authenticated WordPress account is a hard prerequisite and that RCE depends on gadget availability rather than being guaranteed. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; exploitation is realistically limited to sites where open registration or loosely managed Contributor accounts give an outsider a foothold.
Unauthenticated cross-site scripting (XSS) in the BoldGrid Post and Page Builder WordPress plugin (versions <= 1.27.14) allows remote attackers to inject malicious scripts into pages viewed by victims, potentially leading to cookie theft or session hijacking in the victim's browser. Exploitation requires user interaction (UI:R) and the vulnerable plugin to be active, with impact confined to the browser context. No public exploit identified at time of analysis, and no active exploitation has been confirmed.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
Unauthenticated cross-site scripting in the Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin at versions up to and including 3.36 lets an attacker inject script that executes in a victim's browser within the context of the affected WordPress site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the vector is PR:N but UI:R, no credentials are needed to deliver the payload, yet the attack only lands if a victim loads attacker-supplied content or a crafted link that reaches the vulnerable plugin output path; impact is bounded to the client/browser scope (S:C) rather than direct server compromise, with meaningful damage requiring a targeted administrator session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the plugin must be installed and actively rendering the affected gallery/lightbox functionality on a reachable page for exploitation to be possible.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce sites that have the Customer Reviews for WooCommerce plugin installed and active at version 5.120.0 or earlier. The flaw is a missing authorization check (CWE-862) on a network-accessible endpoint, requiring no authentication or user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is a genuine but bounded priority because impact is confined to availability/data loss rather than site compromise.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.
Unauthenticated attackers can modify arbitrary data or trigger protected operations in WordPress sites using the WP Express Checkout (Accept PayPal Payments) plugin versions up to and including 2.4.9, because the plugin fails to enforce authorization controls (CWE-862). The flaw is remotely exploitable without user interaction or credentials, with a CVSS 3.1 base score of 7.5 reflecting high integrity impact but no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a Patchstack advisory exists and administrators should treat the issue as high priority given the unauthenticated attack vector.
Broken access control in the MakeCommerce for WooCommerce WordPress plugin (versions up to and including 4.1.0) lets a low-privilege authenticated Subscriber reach a plugin action that is missing its capability check, allowing unauthorized modification of store data. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2, but our independent assessment adjusts the privilege requirement to PR:L, since the 'Subscriber Broken Access Control' classification implies an authenticated Subscriber session is needed; open registration on many WooCommerce stores makes obtaining such an account trivial. The result is high integrity impact and limited availability impact with no confidentiality exposure, no user interaction required, and no public exploit identified at time of analysis.
Cross-site scripting in the Trusted Shops Easy Integration for WooCommerce plugin through version 2.0.6 allows unauthenticated attackers to deliver crafted input that executes as script in a victim's browser session once that victim is induced to follow a malicious link or request (UI:R, PR:N). Impact is bounded to Low for confidentiality, integrity and availability while the vulnerable component's scope is changed (S:C), producing a 7.1 CVSS base score, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because successful attacks depend on social engineering a store visitor or authenticated administrator, this is a moderate-risk issue rather than an urgent priority; the site must have the plugin installed and active.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
Unauthenticated reflected cross-site scripting in the WooCommerce Product Table Lite WordPress plugin (versions up to and including 5.6.7) allows an attacker to execute arbitrary script in a victim's browser within the affected store's origin by luring that user to a crafted URL or request that reflects the malicious payload, potentially leading to session theft or actions performed as the victim. Exploitation is gated by mandatory user interaction (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires the plugin to be installed and active on a WordPress site that also runs WooCommerce, so practical risk is bounded by the social-engineering step needed to deliver the link. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided; the issue was reported by Patchstack.
Cross-site scripting (XSS) in YITH WooCommerce Ajax Search versions 2.28.0 and earlier allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users, requiring victim interaction such as clicking a crafted link. The vulnerability is rated CVSS 7.1 with a scope change (S:C) and low confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the plugin is widely used in WordPress e-commerce sites, making timely patching advisable.
Unauthenticated cross-site scripting (XSS) in the Classified Listing WordPress plugin (by radiustheme) affects versions up to and including 6.1.3, allowing remote attackers to inject malicious JavaScript that executes in the browser of a victim user who views a crafted page. The CVSS 3.1 score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network exploitation without privileges but requiring user interaction, and limited impact on confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the plugin's widespread use on WordPress sites makes it a potential target for attackers seeking to compromise administrative sessions or deface sites.
Privilege escalation in the Estatik WordPress plugin (versions through 4.3.5) allows an authenticated Subscriber-level account to elevate its privileges to higher roles, potentially achieving full site compromise. Although the published CVSS 3.1 vector lists PR:N (score 9.8), the independent assessment and the 'Subscriber Privilege Escalation' description confirm that a Subscriber account is required; such an account is trivially obtainable when open user registration is enabled, common on real-estate or listing sites. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote code execution in the SiteSkite WordPress plugin through version 2.1.8 lets any remote attacker run arbitrary code on an affected site with no credentials, no user interaction, and no special configuration required (CVSS 10.0, vector PR:N/UI:N/AC:L, scope changed). The underlying weakness is a CWE-94 code injection flaw, and because the plugin is a niche one, the realistically exposed population is small and exploitation is more likely to be opportunistic scanning than broad mass exploitation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the intrinsic severity is high - a single successful request can hand an attacker full control of the WordPress installation and its host context.
Unauthenticated remote attackers can modify or create data in WordPress sites running the Bookly appointment booking plugin versions up to and including 28.2 due to missing authorization checks (CWE-862). The vulnerability has a CVSS score of 7.5 with a vector indicating network exploitable, low complexity, no privileges required, and no user interaction, resulting in high integrity impact but no confidentiality or availability impact. No public exploit code has been identified at the time of analysis, and the issue is assessed as priority-worthy on exploitability but with a bounded impact profile.
Authenticated SQL injection in the weDevs WP ERP plugin for WordPress, affecting all releases up to and including 1.17.9, allows an attacker with Author-level or higher WordPress privileges to inject arbitrary SQL and read data from the site's database. The vulnerability is network-reachable and requires no user interaction, and because the CVSS scope is marked as changed (S:C) with high confidentiality impact (C:H), a successful injection can reach data beyond the plugin's own tables, including other plugins' and core WordPress content. Exploitation is privilege-gated by the PR:H rating, so exposure concentrates on multi-author, membership or community sites where Author accounts are handed to third parties; there is no public exploit identified at time of analysis and no confirmed vendor patch version in the available intelligence, making this a genuine but privilege-gated risk.
SQL injection in the Estatik WordPress plugin (versions <= 4.3.5) allows an authenticated attacker with administrator privileges to read sensitive data from the WordPress database. The vulnerability is a CWE-89 SQL injection in an admin-side function, requiring high privileges (PR:H) but no user interaction. No public exploit code has been identified at the time of analysis, and the primary risk is in environments where administrator access is delegated or on multisite installations where raw database access is not otherwise available.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
PHP object injection in WP ERP 1.17.9 and earlier allows an authenticated high-privilege user to execute arbitrary code or otherwise compromise a WordPress site via deserialization of untrusted input in the plugin's custom role functionality. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability, no user interaction, and high confidentiality, integrity, and availability impact, but the flaw is gated behind a high-privilege prerequisite (PR:H). No public exploit identified at time of analysis; exploitation also requires a reachable POP gadget chain.
Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.
PHP object injection in the quantumcloud Conversational Forms for ChatBot WordPress plugin (versions through 1.5.0) lets any authenticated Subscriber-level user reach full confidentiality, integrity, and availability impact, matching the High 8.8 CVSS 3.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is remote, low-complexity, and requires no user interaction, but real-world severity depends on whether WordPress core or other installed plugins supply a usable PHP POP gadget chain that turns object injection into code execution or destructive file/database operations. No KEV or public-exploit signal was present in the supplied intelligence, so active exploitation is not confirmed from this data.
PHP object injection in the WordPress plugin DesignSetGo 2.8.0 and earlier allows an authenticated user with Contributor-level access to submit a crafted serialized payload, which the plugin then deserializes, potentially leading to data theft, file manipulation, or remote code execution depending on which PHP gadget chains are reachable in the site's loaded code. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms remote, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, and the impact is assessed as high across confidentiality, integrity, and availability - though the practical outcome depends on the presence of a usable gadget chain. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV (not confirmed actively exploited); no EPSS score was supplied, but the self-registerable nature of the Contributor role on many sites keeps the real-world risk elevated.
PHP object injection in the WordPress plugin Go Live Update Urls (Mat Lipe) version 7.0.8 and earlier allows an authenticated attacker holding at least the Contributor role to pass crafted serialized data that the plugin deserializes, potentially leading to full confidentiality, integrity, and availability impact on the affected site if a usable PHP gadget chain is present in the plugin, WordPress core, or another installed theme/plugin. The vulnerability is network-reachable with low attack complexity, requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) and no user interaction; exploitation additionally depends on the availability of a viable POP gadget chain, a common but not universal precondition. At the time of analysis there is no public exploit identified and no confirmation of active exploitation (not listed in CISA KEV), and no vendor-released fixed version is confirmed in the available data. Risk triage should treat this as a high-priority issue for any site running the vulnerable plugin where Contributor accounts are easily obtainable (for example, open self-registration).
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.
Unauthenticated stored cross-site scripting (XSS) in the WordPress plugin Business Essentials for Contact Form 7 (versions ≤1.2.1) allows remote attackers to inject arbitrary web scripts via the 'gateway' form field, which execute when a user views the injected page. Exploitation requires a non-default configuration-the plugin's Payments module must be enabled and a form must be set to accept both PayPal and Stripe as payment gateways-substantially narrowing the affected population. No public exploit code has been identified at time of analysis, and while the CVSS score is 7.2 (High), the specific prerequisites and limited browser-context impact (C:L/I:L, no availability impact) result in a low net real-world priority. A fix is available in plugin changeset 3713721 (versions after 1.2.1).
Stored cross-site scripting in the 10Web Form Maker WordPress plugin through version 1.15.47 lets unauthenticated attackers plant arbitrary JavaScript in a site by submitting crafted Longitude/Latitude values into a 'Mark on Map' form field. The injected script is stored and later rendered without adequate escaping, most practically firing when an administrator opens the submission or map-edit views referenced in the source (Submissions_fm.php, FMMapEditinPopup.php). Wordfence rates it CVSS 3.1 7.2 (High) with a PR:N vector, so no account is needed to inject on a site that publishes a form containing the map field; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated privilege escalation in WPC Shop as a Customer for WooCommerce (versions up to and including 2.0.0) enables any logged-in user to take over an Administrator account by supplying the Administrator's user ID to the wpcsa_login endpoint, receiving a full Administrator session cookie without the Administrator's password. The flaw stems from missing role validation (CWE-269) before issuing a session, and WordPress user IDs are trivially enumerable. No public exploit code is identified at time of analysis, but the vendor-released patch 2.0.1 is available and this is assessed as a genuine high-priority vulnerability.
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
Stored cross-site scripting in the Forminator Forms WordPress plugin (all versions up to and including 1.57.2) allows unauthenticated attackers to plant a script payload in a form submission by abusing insufficient sanitization of a Rich-Text Textarea field. The payload is stored as entry data and only fires when a logged-in administrator opens that specific submission in the Forminator Entries view and clicks the attacker-planted link, at which point WordPress core's jQuery handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML inside the administrator's authenticated wp-admin session. The assessed CVSS 3.1 score is 7.2 (HIGH), driven primarily by the scope change and the vendor's PR:N/UI:N vector, though the independent assessment rates user interaction as required (UI:R) because the exploit is not automatic: it demands a public form containing a rich-text textarea field, a high-privilege victim, and a deliberate click. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so the issue is not confirmed as actively exploited.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (all versions up to and including 5.16.1) allows an unauthenticated attacker to inject arbitrary JavaScript into a WooCommerce order by way of the Billing First Name, Last Name, or Company fields, which are insufficiently sanitized on input and unescaped on output. Because guest checkout is enabled by default on most storefronts, no account or authentication is required to plant the payload; however, the injected script only executes when a privileged user later views the affected order, invoice, or plugin settings page in the WordPress admin context, so a victim must interact with the poisoned record. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix ships in version 5.16.2.
Authenticated WordPress users with only Subscriber-level access can recursively delete arbitrary files and directories - up to and including the entire WordPress installation - on any site running the Super Forms - Drag & Drop Form Builder plugin version 6.3.316 or earlier. Because the super_save_form AJAX handler performs no capability check, a low-privileged attacker can first enable the file_upload_submission_delete setting for the form and then pass an unsanitized subdir value through super_submit_form into SUPER_Common::delete_dir(), with a trivially bypassed ABSPATH guard allowing deletion of wp-config.php and other critical files at the site root. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, the low privilege bar (sites with open registration are effectively exposed to anyone) and the destructive, site-wide impact make this a genuinely high-priority vulnerability rather than a CVSS-inflated paper risk.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.
Unauthenticated attackers can create WordPress administrator accounts on any site running the Super Forms - Drag & Drop Form Builder plugin up to and including version 6.3.316 whenever the Register & Login add-on is active and a registration form using register_login_action='register' is published, because the add-on accepts a client-supplied 'role' parameter and passes it straight into wp_insert_user(). With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the flaw yields full site takeover, but exposure is conditional: the required public registration form must exist, and sites using Super Forms only for contact or other non-registration forms are not affected. No public exploit code has been identified at time of analysis, and an upstream fix is available via GitHub pull request #205, though a released patched version is not independently confirmed in the available data.
Unauthenticated attackers can obtain full WordPress session cookies - including for a Network Super Admin - on any Multisite installation running the Ultimate Multisite (WaaS/SaaS) plugin through version 2.15.0. The flaw lies in the publicly reachable wu_ajax_nopriv_wu_validate_form AJAX handler: supplying checkout_form=wu-finish-checkout discards all validation rules and forces is_last_step() to true, routing the request straight into order processing, where the attacker-supplied email_address is resolved to an existing WordPress user ID without ownership verification and login_customer_after_checkout() issues a passwordless wp_set_auth_cookie() for that user. Exploitation requires only a freely obtainable checkout nonce and the victim's email address (remote, unauthenticated, no user interaction per the CVSS vector PR:N/UI:N), but it succeeds only against accounts that have no pre-existing Ultimate Multisite customer record - such as a Network Super Admin on a fresh Multisite install or any administrator/editor created before the plugin was configured. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the 9.8 score and authentication-bypass-to-admin impact make this a high-priority patch.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated disclosure of payment gateway API credentials affects WordPress sites running the Payments for Hubtel plugin at versions before 1.0.2, because the plugin writes raw payment requests - including the store's Hubtel API keys in plain text - into a debug log that is reachable over the public web. Any remote attacker who knows the log's location can read those credentials without authentication, user interaction, or privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, score 7.5), and because the path is fixed the retrieval is automatable, though CISA's SSVC assessment rates current exploitation as none and no public exploit has been identified at time of analysis; the practical prerequisite is that the site must have processed at least one payment so credentials were actually logged. Impact is confined to confidentiality (C:H with I:N/A:N) - the exposed keys could let an attacker interact with the merchant's Hubtel payment gateway - and the vendor has released a fix in 1.0.2.
Reflected cross-site scripting in the Five Star Restaurant Reviews WordPress plugin (all versions before 2.3.14) lets unauthenticated attackers inject arbitrary JavaScript into an HTML tag via a crafted request that a victim must be socially engineered into submitting, with the script then running in that victim's browser - including a logged-in administrator, where it executes with administrative privileges. The vendor has shipped version 2.3.14 to correct the missing output escaping (CWE-79); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor CVSS 3.1 vector (7.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reachability, low attack complexity, no required privileges, mandatory user interaction, and a scope change caused by script execution in the victim's browser rather than the plugin's own context; our assessment keeps the same vector but sets the availability impact to none (A:N).
Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.
Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.
Stored cross-site scripting in the Paytm Payment Gateway WordPress plugin (all versions before 2.8.9) allows unauthenticated attackers to inject script that later executes in a store administrator's browser session. The plugin fails to sanitize or escape payment callback data before rendering it on an admin page, and the callback integrity check can be forged whenever the gateway is enabled in a credential-less configuration, which is the core non-default prerequisite; exploitation is remote and unauthenticated (PR:N) but requires low attack complexity prerequisites plus user interaction, since a store administrator must subsequently open the affected admin page (UI:R). No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, and a vendor patch is available. Successful exploitation yields script execution in an administrator session, which can lead to full site compromise given the high confidentiality and integrity impact.
Unauthenticated arbitrary file and directory deletion in the Cache Enabler WordPress plugin (all versions before 1.8.17) is possible on sites where some other installed plugin, theme, or integration passes a request-derived URL into Cache Enabler's public cache-clearing hook - a non-default bridging precondition that explains the vendor's AC:H rating despite a CVSS 3.1 base score of 8.7. The purge routine never validates that URL before constructing a filesystem path and never confines the resulting delete operation to the cache directory, producing a scope change (S:C) with high integrity and availability impact while requiring no authentication or user interaction. Patch status: vendor-released patch: 1.8.17; exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated remote attackers can take over WordPress sites running the BackupSheep WordPress Backup Plugin through version 1.8 by supplying a blank or unset integration key that the plugin incorrectly treats as valid, allowing them to generate and download full-site backups containing the database with WordPress user password hashes and to delete arbitrary files on the server. The plugin was closed on WordPress.org in July 2024 and no fixed version exists, so exposure is limited to sites that still have this abandoned plugin installed and active; the defect is rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Cross-site request forgery in the Featured Image from URL (FIFU) WordPress plugin before 6.0.8 and the FIFU Premium plugin before 8.2.8 allows an unauthenticated attacker to make a logged-in administrator's browser execute arbitrary WordPress REST API actions, including creating a brand-new administrator account. The defect is in the plugin's REST API nonce enforcement: supplying a specially crafted URL causes the nonce check to be bypassed for the whole request, so with the victim's admin session active the REST call is accepted without a valid nonce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) the attacker needs no account on the target, but the administrator must be induced to visit an attacker-controlled page, making the attack social-engineering dependent; no public exploit code has been identified at time of analysis, and vendor patches are available.
Unauthenticated stored cross-site scripting in the Extendify plugin for WordPress (all versions up to and including 3.1.6) allows any remote attacker to plant arbitrary JavaScript into pages via the 'styles.blocks' Block Type Key, with no authentication or victim interaction required at injection time. The flaw exists because the plugin's registerIncoming() handler is bound to rest_request_before_callbacks and therefore executes before WordPress evaluates the target route's permission_callback, so a plain POST, PUT, or PATCH to a /wp/v2/global-styles endpoint reaches the vulnerable sanitization path on a default site with the REST API reachable. Impact is browser-side script execution when a victim later loads the injected page, not direct server compromise; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this CVE. Upgrading to version 3.2.0 removes the condition.
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordPress) affects all versions up to and including 5.7.0, allowing an attacker to plant a shortcode payload via the public booking flow that is stored as the customer name and later executed when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and runs it (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). No authentication, user interaction, or special privilege is required to plant the payload, though practical impact is deployment-dependent: the site must expose LatePoint's public booking flow, the Customer Cabinet rendering path must be reachable, and exploitable shortcodes must be registered for the injected payload to have effect. At time of analysis no public exploit code has been identified.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Unauthenticated attackers can harvest customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values from any WordPress site running the Simply Schedule Appointments plugin through version 1.6.12.32 by supplying a crafted 'recursive' parameter to the plugin's appointment REST endpoints. Because the leaked public_token is the sole authorization credential for DELETE /wp-json/ssa/v1/appointments/{id}, the same flaw lets those attackers destroy arbitrary appointment records, which is why the assessed impact includes a low integrity component (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; 7.5 base). No authentication, user interaction, or non-default configuration is required, and no public exploit code or confirmed active exploitation was identified at time of analysis - nevertheless this should be treated as a high-priority issue because it combines bulk PII disclosure with a trivial destructive follow-on against default installs.
PHP object injection in the ThemeHigh 'Extra Product Options For WooCommerce | Custom Product Addons and Fields' plugin through version 3.3.8 allows an authenticated user holding the WooCommerce shop_manager role or higher to pass a crafted serialized payload into a deserialization sink, enabling arbitrary PHP object instantiation that can escalate to code execution or data tampering if a usable gadget chain exists in the surrounding WordPress/WooCommerce stack. The issue is rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high impact but a high-privilege, backend-only prerequisite rather than unauthenticated exposure. There is no public exploit identified at time of analysis, and the plugin has not been confirmed as exploited in the wild; exploitation additionally requires WooCommerce to be installed and active and the plugin to remain at a vulnerable version.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
Cross-site scripting in the Branda WordPress white-labeling plugin (versions up to and including 3.4.32) allows a low-privileged Subscriber-level account to plant JavaScript that then executes in the browser of a higher-privileged user, such as an administrator, who views the affected content - potentially enabling session or administrative actions in that victim's context. The flaw is tracked as CVE-2026-102376 (EUVD-2026-90222), reported by Patchstack, with a published CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); our assessment revises the privilege requirement to PR:L because the 'Subscriber' attack path assumes at least an authenticated low-privileged account, while impact remains confined to the browser JavaScript context (low confidentiality, integrity and availability). No public exploit identified at time of analysis, and there is no CISA KEV entry confirming active exploitation.
PHP object injection in the WordPress plugin Nested Pages (wp-nested-pages, by Hook & Filter) in versions up to and including 3.3.2 lets an attacker who holds at least a Contributor-level account on the affected site submit crafted serialized data that is passed to PHP's unserialization logic, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, to code execution, data theft, or full site compromise. The reported base score of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vendor's own 'Contributor PHP Object Injection' designation; the authoritative assessment re-scores the issue as AV:N/AC:H/PR:L/UI:N, reflecting that a low-privileged authenticated WordPress account is a hard prerequisite and that RCE depends on gadget availability rather than being guaranteed. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is not confirmed as actively exploited; exploitation is realistically limited to sites where open registration or loosely managed Contributor accounts give an outsider a foothold.
Unauthenticated cross-site scripting (XSS) in the BoldGrid Post and Page Builder WordPress plugin (versions <= 1.27.14) allows remote attackers to inject malicious scripts into pages viewed by victims, potentially leading to cookie theft or session hijacking in the victim's browser. Exploitation requires user interaction (UI:R) and the vulnerable plugin to be active, with impact confined to the browser context. No public exploit identified at time of analysis, and no active exploitation has been confirmed.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
Unauthenticated cross-site scripting in the Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin at versions up to and including 3.36 lets an attacker inject script that executes in a victim's browser within the context of the affected WordPress site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the vector is PR:N but UI:R, no credentials are needed to deliver the payload, yet the attack only lands if a victim loads attacker-supplied content or a crafted link that reaches the vulnerable plugin output path; impact is bounded to the client/browser scope (S:C) rather than direct server compromise, with meaningful damage requiring a targeted administrator session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the plugin must be installed and actively rendering the affected gallery/lightbox functionality on a reachable page for exploitation to be possible.
PHP object injection in Page Builder by SiteOrigin (siteorigin-panels) version 2.36.0 and earlier allows an authenticated WordPress user holding high privileges - an Administrator or the Editor-level role implied by the advisory - to supply crafted, serialized content through the page-builder editor that the plugin then deserializes, yielding high confidentiality, integrity and availability impact (CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the flaw is a CWE-502 deserialization issue, weaponization into full remote code execution depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or another installed component, so the practical worst case is conditional rather than guaranteed. There is currently no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the high-privilege authentication prerequisite is the main barrier to mass abuse, not the technical difficulty - low-privilege or anonymous users cannot reach it.
Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Reflected cross-site scripting in the If-So Dynamic Content Personalization plugin for WordPress (versions up to and including 1.10.1) lets unauthenticated remote attackers inject and execute arbitrary JavaScript in a victim's browser session. Exploitation is conditional on victim interaction - an administrator or site visitor must click a crafted link or load an attacker-influenced page - so there is no server-side compromise without that step; the assessed CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-severity, broadly applicable WordPress plugin risk rather than a confirmed active campaign.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Reflected cross-site scripting in the WordPress plugin Quiz And Survey Master (slug quiz-master-next) through version 11.2.6 allows unauthenticated attackers to inject script that executes in a victim's browser after the victim clicks a crafted link or submits attacker-controlled input that the plugin then reflects. The issue is scored CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and independent assessment characterizes it as a genuine but moderate-priority web vulnerability: per the assessed vector, no authentication is required but successful exploitation depends on user interaction, and impact stays within the victim's browser/site security context rather than yielding direct server compromise. Risk is elevated when the lured victim is an authenticated administrator, because the injected script then runs with that user's privileges; no public exploit identified at time of analysis, and no KEV listing or product-specific EPSS estimate was supplied.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Unauthenticated PHP object injection (CWE-502) in the WordPress plugin Booking Activities, affecting versions through 1.18.7.1, allows remote attackers to reach plugin endpoints and pass attacker-controlled data into PHP unserialize() with no authentication or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Potential impact includes code execution, file read/write, or denial of service, but real-world severity depends on the presence of a usable POP gadget chain in the plugin, WordPress core, or another loaded plugin/theme. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the limited 'Shop Worker' store-staff role to elevate to full administrator-level control of the WordPress site. The flaw is a case of incorrect privilege assignment (CWE-266) inside a SureCart operation, and because the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, no user interaction or special conditions are needed once the Shop Worker role is held - making it a straightforward path for a malicious insider or anyone who has compromised a shop-staff credential. Anonymous or self-registering visitors cannot reach the flaw; there is no public exploit identified at time of analysis.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
Unauthenticated cross-site scripting in the JetEngine WordPress plugin (versions 3.8.14.3 and earlier) allows a remote attacker to have attacker-controlled script execute in a victim's browser context once that victim loads an attacker-influenced page or crafted URL. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, CVSS 7.1), no authentication is needed to deliver the payload, but exploitation requires victim interaction and the exact vulnerable feature or parameter is not disclosed in the advisory summary; impact scales with the privilege of the user who triggers it, making an administrator the highest-value target. Reported by Patchstack, this flaw has no public exploit code and no CISA KEV entry identified at time of analysis, and no EPSS signal was supplied.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Cross-site request forgery in the WordPress plugin Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification (versions through 2.3.1) lets a remote, unauthenticated attacker forge state-changing requests that execute with the privileges of a logged-in victim who loads attacker-controlled content. Exploitation is not autonomous: it requires an authenticated user with a live session - typically an administrator or shop manager - on a site where WooCommerce and this plugin are both installed and active, and that user must be tricked into visiting a malicious page (CVSS UI:R, PR:N means the attacker needs no credentials of their own, not that the victim is anonymous). The published CVSS 3.1 base score of 8.8 (C:H/I:H/A:H) appears inflated for a CSRF issue; our independent assessment rates it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L, reflecting high integrity impact but limited confidentiality and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
PHP object injection in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (versions through 3.5.51) allows an authenticated user holding the Editor role to feed crafted serialized data into a plugin code path that calls PHP's unserialize, which can lead to code execution, file operations, or data tampering if a viable POP gadget chain exists in the plugin or elsewhere on the site. The issue is network-reachable and needs no user interaction, but exploitation is access-gated by the Editor-privilege prerequisite, and no public exploit code has been identified at time of analysis; EPSS data was not provided.
PHP object injection in the WordPress plugin Content Egg through version 6.3.1 allows an attacker who holds the Shop manager role to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The vulnerability is network-reachable with low attack complexity and requires no user interaction, but the PR:H rating in the CVSS vector means a valid authenticated account at the Shop manager privilege level is a prerequisite, and meaningful code-execution impact further depends on the presence of a usable PHP POP gadget chain in Content Egg or another loaded plugin or theme. No public exploit code has been identified at time of analysis, and there is no indication that the flaw is being actively exploited in the wild.
Authenticated Contributor-level users can exploit a PHP Object Injection vulnerability in Themify Builder versions up to and including 7.8.1. The flaw, caused by unsafe deserialization (CWE-502), allows an attacker with a Contributor account to inject a serialized PHP object, potentially leading to remote code execution or full site compromise if a usable PHP gadget chain exists in the WordPress installation. The vendor-assigned CVSS score is 8.8 (High), and no public exploit code has been identified at the time of analysis.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce sites that have the Customer Reviews for WooCommerce plugin installed and active at version 5.120.0 or earlier. The flaw is a missing authorization check (CWE-862) on a network-accessible endpoint, requiring no authentication or user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is a genuine but bounded priority because impact is confined to availability/data loss rather than site compromise.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.
Unauthenticated attackers can modify arbitrary data or trigger protected operations in WordPress sites using the WP Express Checkout (Accept PayPal Payments) plugin versions up to and including 2.4.9, because the plugin fails to enforce authorization controls (CWE-862). The flaw is remotely exploitable without user interaction or credentials, with a CVSS 3.1 base score of 7.5 reflecting high integrity impact but no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, but a Patchstack advisory exists and administrators should treat the issue as high priority given the unauthenticated attack vector.
Broken access control in the MakeCommerce for WooCommerce WordPress plugin (versions up to and including 4.1.0) lets a low-privilege authenticated Subscriber reach a plugin action that is missing its capability check, allowing unauthorized modification of store data. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2, but our independent assessment adjusts the privilege requirement to PR:L, since the 'Subscriber Broken Access Control' classification implies an authenticated Subscriber session is needed; open registration on many WooCommerce stores makes obtaining such an account trivial. The result is high integrity impact and limited availability impact with no confidentiality exposure, no user interaction required, and no public exploit identified at time of analysis.
Cross-site scripting in the Trusted Shops Easy Integration for WooCommerce plugin through version 2.0.6 allows unauthenticated attackers to deliver crafted input that executes as script in a victim's browser session once that victim is induced to follow a malicious link or request (UI:R, PR:N). Impact is bounded to Low for confidentiality, integrity and availability while the vulnerable component's scope is changed (S:C), producing a 7.1 CVSS base score, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because successful attacks depend on social engineering a store visitor or authenticated administrator, this is a moderate-risk issue rather than an urgent priority; the site must have the plugin installed and active.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
Unauthenticated reflected cross-site scripting in the WooCommerce Product Table Lite WordPress plugin (versions up to and including 5.6.7) allows an attacker to execute arbitrary script in a victim's browser within the affected store's origin by luring that user to a crafted URL or request that reflects the malicious payload, potentially leading to session theft or actions performed as the victim. Exploitation is gated by mandatory user interaction (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires the plugin to be installed and active on a WordPress site that also runs WooCommerce, so practical risk is bounded by the social-engineering step needed to deliver the link. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided; the issue was reported by Patchstack.
Cross-site scripting (XSS) in YITH WooCommerce Ajax Search versions 2.28.0 and earlier allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users, requiring victim interaction such as clicking a crafted link. The vulnerability is rated CVSS 7.1 with a scope change (S:C) and low confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the plugin is widely used in WordPress e-commerce sites, making timely patching advisable.
Unauthenticated cross-site scripting (XSS) in the Classified Listing WordPress plugin (by radiustheme) affects versions up to and including 6.1.3, allowing remote attackers to inject malicious JavaScript that executes in the browser of a victim user who views a crafted page. The CVSS 3.1 score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network exploitation without privileges but requiring user interaction, and limited impact on confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the plugin's widespread use on WordPress sites makes it a potential target for attackers seeking to compromise administrative sessions or deface sites.
Privilege escalation in the Estatik WordPress plugin (versions through 4.3.5) allows an authenticated Subscriber-level account to elevate its privileges to higher roles, potentially achieving full site compromise. Although the published CVSS 3.1 vector lists PR:N (score 9.8), the independent assessment and the 'Subscriber Privilege Escalation' description confirm that a Subscriber account is required; such an account is trivially obtainable when open user registration is enabled, common on real-estate or listing sites. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote code execution in the SiteSkite WordPress plugin through version 2.1.8 lets any remote attacker run arbitrary code on an affected site with no credentials, no user interaction, and no special configuration required (CVSS 10.0, vector PR:N/UI:N/AC:L, scope changed). The underlying weakness is a CWE-94 code injection flaw, and because the plugin is a niche one, the realistically exposed population is small and exploitation is more likely to be opportunistic scanning than broad mass exploitation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the intrinsic severity is high - a single successful request can hand an attacker full control of the WordPress installation and its host context.
Unauthenticated remote attackers can modify or create data in WordPress sites running the Bookly appointment booking plugin versions up to and including 28.2 due to missing authorization checks (CWE-862). The vulnerability has a CVSS score of 7.5 with a vector indicating network exploitable, low complexity, no privileges required, and no user interaction, resulting in high integrity impact but no confidentiality or availability impact. No public exploit code has been identified at the time of analysis, and the issue is assessed as priority-worthy on exploitability but with a bounded impact profile.
Authenticated SQL injection in the weDevs WP ERP plugin for WordPress, affecting all releases up to and including 1.17.9, allows an attacker with Author-level or higher WordPress privileges to inject arbitrary SQL and read data from the site's database. The vulnerability is network-reachable and requires no user interaction, and because the CVSS scope is marked as changed (S:C) with high confidentiality impact (C:H), a successful injection can reach data beyond the plugin's own tables, including other plugins' and core WordPress content. Exploitation is privilege-gated by the PR:H rating, so exposure concentrates on multi-author, membership or community sites where Author accounts are handed to third parties; there is no public exploit identified at time of analysis and no confirmed vendor patch version in the available intelligence, making this a genuine but privilege-gated risk.
SQL injection in the Estatik WordPress plugin (versions <= 4.3.5) allows an authenticated attacker with administrator privileges to read sensitive data from the WordPress database. The vulnerability is a CWE-89 SQL injection in an admin-side function, requiring high privileges (PR:H) but no user interaction. No public exploit code has been identified at the time of analysis, and the primary risk is in environments where administrator access is delegated or on multisite installations where raw database access is not otherwise available.
PHP object injection in the Implecode eCommerce Product Catalog plugin for WordPress (3.6.0 and earlier) allows an authenticated attacker holding a high-privilege custom role to feed crafted serialized data into PHP's unserialize(), enabling arbitrary object instantiation that can escalate to remote code execution where a usable POP gadget chain exists in loaded code. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), it carries full confidentiality, integrity and availability impact, but is access-gated: the high-privilege custom role requirement (PR:H) means anonymous and low-privileged users cannot reach the vulnerable path, so this is a genuine but access-gated risk rather than an internet-wide exposure. No public exploit identified at time of analysis.
PHP object injection in WP ERP 1.17.9 and earlier allows an authenticated high-privilege user to execute arbitrary code or otherwise compromise a WordPress site via deserialization of untrusted input in the plugin's custom role functionality. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability, no user interaction, and high confidentiality, integrity, and availability impact, but the flaw is gated behind a high-privilege prerequisite (PR:H). No public exploit identified at time of analysis; exploitation also requires a reachable POP gadget chain.
Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.
PHP object injection in the quantumcloud Conversational Forms for ChatBot WordPress plugin (versions through 1.5.0) lets any authenticated Subscriber-level user reach full confidentiality, integrity, and availability impact, matching the High 8.8 CVSS 3.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is remote, low-complexity, and requires no user interaction, but real-world severity depends on whether WordPress core or other installed plugins supply a usable PHP POP gadget chain that turns object injection into code execution or destructive file/database operations. No KEV or public-exploit signal was present in the supplied intelligence, so active exploitation is not confirmed from this data.
PHP object injection in the WordPress plugin DesignSetGo 2.8.0 and earlier allows an authenticated user with Contributor-level access to submit a crafted serialized payload, which the plugin then deserializes, potentially leading to data theft, file manipulation, or remote code execution depending on which PHP gadget chains are reachable in the site's loaded code. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms remote, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, and the impact is assessed as high across confidentiality, integrity, and availability - though the practical outcome depends on the presence of a usable gadget chain. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV (not confirmed actively exploited); no EPSS score was supplied, but the self-registerable nature of the Contributor role on many sites keeps the real-world risk elevated.
PHP object injection in the WordPress plugin Go Live Update Urls (Mat Lipe) version 7.0.8 and earlier allows an authenticated attacker holding at least the Contributor role to pass crafted serialized data that the plugin deserializes, potentially leading to full confidentiality, integrity, and availability impact on the affected site if a usable PHP gadget chain is present in the plugin, WordPress core, or another installed theme/plugin. The vulnerability is network-reachable with low attack complexity, requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) and no user interaction; exploitation additionally depends on the availability of a viable POP gadget chain, a common but not universal precondition. At the time of analysis there is no public exploit identified and no confirmation of active exploitation (not listed in CISA KEV), and no vendor-released fixed version is confirmed in the available data. Risk triage should treat this as a high-priority issue for any site running the vulnerable plugin where Contributor accounts are easily obtainable (for example, open self-registration).
PHP object injection in Kadence WooCommerce Email Designer (versions up to and including 1.5.19.1) lets an authenticated account holding the WooCommerce 'Shop manager' role pass attacker-controlled serialized data into a PHP unserialize() path, potentially leading to arbitrary file manipulation, data disclosure, or remote code execution if a suitable property-oriented programming gadget chain exists in the loaded codebase. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable without user interaction but is firmly privilege-gated behind high-privilege store management access rather than anonymous exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical ceiling of impact depends on which gadget chains are present alongside the plugin.