Wpkube
Monthly
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Social Sharing Plugin - Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Sensitive data exposure in the Subscribe To Comments Reloaded WordPress plugin (versions through 220725) allows unauthenticated remote attackers to retrieve information written to application log files. The plugin inserts sensitive data - likely subscriber email addresses, tokens, or configuration values - into log files that appear to be accessible without authentication, based on the PR:N/AV:N CVSS vector assigned by Patchstack. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though its EPSS of 0.76% places it at the 73rd percentile, suggesting elevated machine-learning-derived risk relative to the broader CVE population.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.
The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Social Sharing Plugin - Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Sensitive data exposure in the Subscribe To Comments Reloaded WordPress plugin (versions through 220725) allows unauthenticated remote attackers to retrieve information written to application log files. The plugin inserts sensitive data - likely subscriber email addresses, tokens, or configuration values - into log files that appear to be accessible without authentication, based on the PR:N/AV:N CVSS vector assigned by Patchstack. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though its EPSS of 0.76% places it at the 73rd percentile, suggesting elevated machine-learning-derived risk relative to the broader CVE population.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.