Wp W3All Phpbb
Monthly
Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Stored cross-site scripting in the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration, versions through 3.1.0) lets an authenticated low-privileged user plant script content that is persisted server-side and later executed in the browser of any user who views the rendered page, rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Exploitation requires a valid account on the WordPress site (at least low privileges per PR:L) plus a second user who loads the affected content (UI:R), and it presupposes the plugin is installed and active - a niche integration deployment that narrows the realistic target set. Reported by Patchstack; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.
Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.
SQL injection in the WP w3all phpBB WordPress plugin (versions ≤ 3.0.5) allows any authenticated subscriber to extract sensitive data from the underlying database via unsanitized query input. The CVSS scope change metric (S:C) combined with high confidentiality impact (C:H) indicates the injection can reach beyond the plugin's own data - potentially exposing phpBB user credentials, private messages, or WordPress core tables. No public exploit code or CISA KEV listing is identified at time of analysis; however, the low authentication barrier (subscriber-level) makes this accessible to any registered WordPress user.
Stored cross-site scripting in the WP w3all phpBB integration plugin (wp-w3all-phpbb-integration, versions through 3.1.0) lets an authenticated low-privileged user plant script content that is persisted server-side and later executed in the browser of any user who views the rendered page, rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Exploitation requires a valid account on the WordPress site (at least low privileges per PR:L) plus a second user who loads the affected content (UI:R), and it presupposes the plugin is installed and active - a niche integration deployment that narrows the realistic target set. Reported by Patchstack; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.