Wppool
Monthly
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
Stored cross-site scripting in the WPPOOL FormyChat (social-contact-form) WordPress plugin, versions up to and including 2.15.3, lets remote attackers inject persistent JavaScript that executes in the browser of anyone who later views the affected page. Reported by Patchstack (CVSS 7.1), the scope-changing flaw can be abused to hijack sessions, deface content, or pivot toward WordPress administrator accounts. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the FlexStock - Product Stock Sync with Google Sheets for WooCommerce plugin affects every version through 3.17.2, letting a logged-in Subscriber-level user write arbitrary script into the products[].post_content field that later executes in the browser of anyone viewing the injected page. The low barrier is structural rather than a misconfiguration: the plugin's admin_enqueue_scripts callback prints the REST bearer token into the Dashboard page source via wp_localize_script() with no capability check, and the REST endpoint's permission_callback validates only that token instead of calling current_user_can(), so any Subscriber can reach the write path without plugin-specific setup. Wordfence reported it as a medium-severity issue (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and priority is set to this month.
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.
FlexTable WordPress plugin (versions up to and including 3.24.0) by WPPOOL contains a missing authorization vulnerability enabling low-privileged authenticated users to perform restricted plugin actions beyond their intended access level, resulting in limited but unauthorized integrity modifications. The flaw stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that an authenticated user holds the required WordPress capability before executing privileged operations. No public exploit code exists and this vulnerability is not in the CISA Known Exploited Vulnerabilities catalog; EPSS scoring at 0.03% (8th percentile) confirms negligible likelihood of broad exploitation at this time.
The WP Dark Mode - WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
Stored cross-site scripting in the WPPOOL FormyChat (social-contact-form) WordPress plugin, versions up to and including 2.15.3, lets remote attackers inject persistent JavaScript that executes in the browser of anyone who later views the affected page. Reported by Patchstack (CVSS 7.1), the scope-changing flaw can be abused to hijack sessions, deface content, or pivot toward WordPress administrator accounts. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stored cross-site scripting in the FlexStock - Product Stock Sync with Google Sheets for WooCommerce plugin affects every version through 3.17.2, letting a logged-in Subscriber-level user write arbitrary script into the products[].post_content field that later executes in the browser of anyone viewing the injected page. The low barrier is structural rather than a misconfiguration: the plugin's admin_enqueue_scripts callback prints the REST bearer token into the Dashboard page source via wp_localize_script() with no capability check, and the REST endpoint's permission_callback validates only that token instead of calling current_user_can(), so any Subscriber can reach the write path without plugin-specific setup. Wordfence reported it as a medium-severity issue (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and priority is set to this month.
Stored cross-site scripting in the WPPool 'Dark Mode - Improve Accessibility with AI Powered Dark Theme' WordPress plugin (all versions up to and including 5.3.17) allows attackers holding a Contributor-level account or higher to inject arbitrary JavaScript via the 'icon_light' shortcode attribute, which then executes in the browser of any visitor who later loads the injected page. Authentication is required and the privilege gate is Contributor-and-above (CVSS vector PR:L, scope changed), so sites that tightly control or disable self-registration and editorial roles are largely insulated. No public exploit code and no confirmed active exploitation have been identified at time of analysis; EPSS and KEV data were not provided.
FlexTable WordPress plugin (versions up to and including 3.24.0) by WPPOOL contains a missing authorization vulnerability enabling low-privileged authenticated users to perform restricted plugin actions beyond their intended access level, resulting in limited but unauthorized integrity modifications. The flaw stems from CWE-862 (Missing Authorization), where plugin endpoints fail to verify that an authenticated user holds the required WordPress capability before executing privileged operations. No public exploit code exists and this vulnerability is not in the CISA Known Exploited Vulnerabilities catalog; EPSS scoring at 0.03% (8th percentile) confirms negligible likelihood of broad exploitation at this time.
The WP Dark Mode - WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress is vulnerable to unauthorized modification of data due to a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.