Wpdevteam
Monthly
Stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.4) lets unauthenticated attackers plant arbitrary web scripts through the public job-application 'cover_letter' field, which the plugin later renders without adequate escaping inside its React-based admin interface. The injection point is the plugin's default, publicly reachable application flow and needs no credentials or non-default configuration, but execution is gated: a logged-in administrator must open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses an encoded scheme back to javascript: and the payload fires in the admin's session. No public exploit code has been identified at time of analysis; the requirement for privileged, active administrator interaction is the main constraint on real-world exploitation, and the issue sits in this week's remediation queue rather than an emergency one.
Unauthenticated privilege escalation in the Essential Addons for Elementor plugin (all versions up to and including 6.8.7) lets any site visitor register an account with a role as high as Editor - gaining edit_others_posts, publish_pages, upload_files and unfiltered_html - by passing a WordPress revision ID as the page_id parameter of the register_user() handler. The escalation is not a default-configuration drive-by: the site must have "Anyone can register" enabled, a page must carry the plugin's Login/Register widget, and an administrator must at some point have saved and then reverted a non-default "New User Role" on that page, leaving a revision whose _elementor_data still holds the elevated role. Those attacker-uncontrolled, non-default prerequisites are why the vector scores AC:H despite PR:N; no public exploit has been identified at time of analysis and the issue is not in CISA KEV. In practice this is a genuine but conditionally-gated issue rather than a drop-everything emergency, though the impact when the preconditions are met is full administrative-adjacent compromise of site content.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contributor-or-above user inject a Bcc header into WordPress's administrator password-reset email via the plugin's Login/Register widget, capturing a valid admin reset link and seizing the site. The flaw stems from an email-header (CRLF) injection where the allowed-values check is enforced only in the browser editor, not server-side. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor fixed it in version 6.6.11.
Authenticated stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.2) lets an attacker with contributor-level access or above inject arbitrary script into the 'icon' attribute of the easyjobs/job-list Gutenberg block, with the payload executing for every visitor who renders the affected page. Sites that restrict content-authoring roles to trusted staff are substantially less exposed, since the attacker must already hold a contributor+ account or be able to register one; sites not using the job-list block are unaffected in practice. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Stored cross-site scripting in the Essential Blocks - Page Builder for Gutenberg Blocks & Patterns WordPress plugin (versions up to and including 6.4.5) allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes when a victim views the affected page. The flaw sits in the Google Map block's 'marker' attribute: marker title/content values are stored as JSON and later decoded and concatenated directly into raw HTML by the frontend InfoWindow builder, so it is insufficient input sanitization plus missing output escaping rather than a logic error. It is network-reachable at low complexity with a scope change (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium); the practical barrier is the Contributor authentication requirement, and no public exploit code was identified at time of analysis. Sites that allow open registration or grant Contributor roles to low-trust users should treat this as a priority upgrade.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
SQL Injection in the BetterDocs WordPress plugin (versions up to and including 4.6.0) enables authenticated attackers holding at minimum a custom-level WordPress role to append arbitrary SQL to existing queries via the unsanitized `lang` parameter, extracting sensitive data from the underlying database. The attack surface is restricted to sites where one of five specific multilingual plugins (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is guarded by `Helper::is_multilingual_active()`. No public exploit identified at time of analysis; EPSS data unavailable, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Essential Addons for Elementor (versions up to and including 6.6.2) allows authenticated WordPress users with Author-level access or higher to inject persistent malicious JavaScript via event titles rendered through the Event Calendar widget. The injected payload executes in the browsers of any user who visits the affected page, with scope change confirmed by the CVSS:3.1 S:C designation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low on sites that permit contributor or author registration.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Stored Cross-Site Scripting in BetterDocs WordPress plugin (versions ≤4.5.3) allows authenticated contributors to inject persistent malicious scripts via the unescaped blockId attribute of the betterdocs/category-slate-layout Gutenberg block. The injected payload executes in the browser of any visitor who loads the compromised page, enabling session hijacking, credential theft, or admin-level privilege escalation against site operators. No public exploit identified at time of analysis, but the contributor-level authentication threshold makes this accessible on any WordPress site permitting open or shared content authorship.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's `register_user` function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.4) lets unauthenticated attackers plant arbitrary web scripts through the public job-application 'cover_letter' field, which the plugin later renders without adequate escaping inside its React-based admin interface. The injection point is the plugin's default, publicly reachable application flow and needs no credentials or non-default configuration, but execution is gated: a logged-in administrator must open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses an encoded scheme back to javascript: and the payload fires in the admin's session. No public exploit code has been identified at time of analysis; the requirement for privileged, active administrator interaction is the main constraint on real-world exploitation, and the issue sits in this week's remediation queue rather than an emergency one.
Unauthenticated privilege escalation in the Essential Addons for Elementor plugin (all versions up to and including 6.8.7) lets any site visitor register an account with a role as high as Editor - gaining edit_others_posts, publish_pages, upload_files and unfiltered_html - by passing a WordPress revision ID as the page_id parameter of the register_user() handler. The escalation is not a default-configuration drive-by: the site must have "Anyone can register" enabled, a page must carry the plugin's Login/Register widget, and an administrator must at some point have saved and then reverted a non-default "New User Role" on that page, leaving a revision whose _elementor_data still holds the elevated role. Those attacker-uncontrolled, non-default prerequisites are why the vector scores AC:H despite PR:N; no public exploit has been identified at time of analysis and the issue is not in CISA KEV. In practice this is a genuine but conditionally-gated issue rather than a drop-everything emergency, though the impact when the preconditions are met is full administrative-adjacent compromise of site content.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Authenticated account takeover in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.10) lets a Contributor-or-above user inject a Bcc header into WordPress's administrator password-reset email via the plugin's Login/Register widget, capturing a valid admin reset link and seizing the site. The flaw stems from an email-header (CRLF) injection where the allowed-values check is enforced only in the browser editor, not server-side. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor fixed it in version 6.6.11.
Authenticated stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.2) lets an attacker with contributor-level access or above inject arbitrary script into the 'icon' attribute of the easyjobs/job-list Gutenberg block, with the payload executing for every visitor who renders the affected page. Sites that restrict content-authoring roles to trusted staff are substantially less exposed, since the attacker must already hold a contributor+ account or be able to register one; sites not using the job-list block are unaffected in practice. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Unauthenticated content injection in the WordPress NotificationX plugin (WPDevTeam) - versions up to and including 3.3.3 - allows remote attackers to write forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign by POSTing an arbitrary nx_id to the /notificationx/v1/popup-submit REST route. That route is registered with permission_callback => '__return_true', so no authentication, user interaction, or non-default plugin setting is needed, although exploitation does depend on at least one non-popup campaign (WP Comments, WooCommerce/EDD/Give sales, reviews, etc.) already existing and being enabled on the target site. The impact is confined to the integrity of displayed notification content (CVSS 5.3 Medium - no confidentiality or availability loss), no public exploit code has been identified at time of analysis, and the issue is not flagged as actively exploited.
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Stored cross-site scripting in the Essential Blocks - Page Builder for Gutenberg Blocks & Patterns WordPress plugin (versions up to and including 6.4.5) allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes when a victim views the affected page. The flaw sits in the Google Map block's 'marker' attribute: marker title/content values are stored as JSON and later decoded and concatenated directly into raw HTML by the frontend InfoWindow builder, so it is insufficient input sanitization plus missing output escaping rather than a logic error. It is network-reachable at low complexity with a scope change (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium); the practical barrier is the Contributor authentication requirement, and no public exploit code was identified at time of analysis. Sites that allow open registration or grant Contributor roles to low-trust users should treat this as a priority upgrade.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
SQL Injection in the BetterDocs WordPress plugin (versions up to and including 4.6.0) enables authenticated attackers holding at minimum a custom-level WordPress role to append arbitrary SQL to existing queries via the unsanitized `lang` parameter, extracting sensitive data from the underlying database. The attack surface is restricted to sites where one of five specific multilingual plugins (WPML, Polylang, qTranslate, Weglot, or TranslatePress) is active, as the vulnerable code path is guarded by `Helper::is_multilingual_active()`. No public exploit identified at time of analysis; EPSS data unavailable, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Essential Addons for Elementor (versions up to and including 6.6.2) allows authenticated WordPress users with Author-level access or higher to inject persistent malicious JavaScript via event titles rendered through the Event Calendar widget. The injected payload executes in the browsers of any user who visits the affected page, with scope change confirmed by the CVSS:3.1 S:C designation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low on sites that permit contributor or author registration.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Stored Cross-Site Scripting in BetterDocs WordPress plugin (versions ≤4.5.3) allows authenticated contributors to inject persistent malicious scripts via the unescaped blockId attribute of the betterdocs/category-slate-layout Gutenberg block. The injected payload executes in the browser of any visitor who loads the compromised page, enabling session hijacking, credential theft, or admin-level privilege escalation against site operators. No public exploit identified at time of analysis, but the contributor-level authentication threshold makes this accessible on any WordPress site permitting open or shared content authorship.
Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.
Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.
Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's `register_user` function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.
BetterDocs plugin for WordPress versions up to 4.3.11 allows authenticated subscribers and higher to trigger arbitrary OpenAI API calls using the site's configured API key due to missing capability checks in the generate_openai_content_callback() function. An attacker with subscriber-level access can supply arbitrary prompts to exhaust the site owner's paid AI API quota without authorization, resulting in unauthorized financial impact and service degradation. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.