Vulnerabilities

The Design Scuole Italia WordPress theme, a theme purpose-built for Italian school websites, contains multiple missing-authorization flaws (CWE-862) in its dsi_pdf_generator and dsi_csv_generator functions, resulting in sensitive-information exposure (CWE-200). An unauthenticated remote attacker can invoke these PDF/CSV export functions directly to retrieve restricted 'Circolare' (school circular/notice) content and data belonging to registered users without any credentials. Exploitation is further eased by an unauthenticated RSS feed at /circolare/feed/, which makes restricted circular content trivially harvestable in bulk. The issue is rated CVSS 4.0 8.7 (high) because it is network-exploitable with no privileges, no user interaction, and high confidentiality impact. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: Update the Design Scuole Italia theme to the latest available release as soon as a patched version is published, and verify with the maintainers which version fixes the dsi_pdf_generator/dsi_csv_generator flaws. Until then, block or require authentication for requests hitting the PDF/CSV generator endpoints and the /circolare/feed/ RSS feed (e.g., via a security plugin or web-server rules), and review access logs for unauthenticated access to these paths. Also audit whether restricted Circolare content or registered-user data has already been exported, and consider rotating user data if leaks are confirmed.

The Design Scuole Italia WordPress theme contains an unauthenticated path traversal flaw (CWE-22) in the reserved_file_check function of functions.php, rated 8.7 (high) under CVSS 4.0. A remote attacker with no credentials can send a crafted request with traversal sequences to a file-download endpoint handled by the theme, tricking it into serving files outside the intended directory. Successful exploitation discloses arbitrary files readable by the web server process, most critically wp-config.php, which contains database credentials, salts, and keys. Affected parties are WordPress sites — primarily Italian school websites — running an unpatched version of the theme; the advisory data does not specify an exact affected version range. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation has been observed.

Do: Update the Design Scuole Italia theme to the latest release from the official repository and confirm the reserved_file_check function in functions.php is patched. Inspect access logs for unauthenticated file-download requests containing dot-dot path traversal patterns or successful retrieval of sensitive files such as wp-config.php, /etc/passwd, or environment files. As defense-in-depth, block traversal sequences in download parameters via WAF rules, and rotate database credentials and authentication salts if any suspicious file access is found.

The MotoPress Hotel Booking plugin for WordPress contains a stored cross-site scripting flaw in the premium Stripe gateway's webhook listener (webhook-listener.php), affecting all versions up to and including 6.2.4. Because the plugin only verifies the Stripe webhook signature when an optional signing secret is configured — and that secret is empty by default — an unauthenticated attacker can send a forged webhook event (e.g., a fake 'refund.created') that is accepted without cryptographic verification. The attacker-controlled event object 'id' is then written unescaped into the payment log and executes as arbitrary JavaScript when an administrator views the payment in the WordPress dashboard. Exploitation requires knowledge of a valid Stripe PaymentIntent ID for an existing payment, which limits the attacker pool to those with some visibility into a site's transactions. The vulnerable handler exists only in the premium Stripe integration, not the lite plugin, and no public PoC or in-the-wild exploitation is currently known.

Do: Update MotoPress Hotel Booking to a version newer than 6.2.4 as soon as a patched release is available. Immediately configure the Stripe webhook signing secret in the plugin settings — this forces cryptographic verification of incoming webhooks and blocks forged events even on unpatched installs. Review payment log entries and admin-facing payment pages for unexpected or injected script content, and check Stripe dashboard webhook delivery logs for events that do not correspond to legitimate Stripe-originated transactions.

The Consulting theme for WordPress, in versions up to and including 6.7.16, chains two flaws that let any authenticated user with subscriber-level access or above escalate to full administrator privileges. The unprotected masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php allows an attacker to set arbitrary transients without capability checks or nonce validation, so they can set stm_developer_access_token to a known value (1). Because the developer-access login mechanism in admin/classes/stm-theme-support.php trusts that transient for authentication when running in legacy string mode, visiting a specially crafted URL then logs the attacker in as any existing user, including administrators. Any site running the theme at or below 6.7.16 where an attacker can obtain even a low-privileged account (e.g., via open registration) is affected. No public PoC exists and no exploitation in the wild has been reported, though the attack is straightforward to reproduce for anyone with the technical details.

Do: Update to the latest Consulting theme release (any version newer than 6.7.16) as soon as the vendor ships a fix; until then, disable open user registration and audit existing low-privileged accounts. Check for unexpected stm_developer_access_token transient values and any newly created or modified administrator accounts, and consider a WAF rule blocking the masterstudy_ms_stm_set_discard_transient AJAX action and the developer-access login URL.

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.1.23. Its PermissionManager::manage_permissions() function, hooked to WordPress core's map_meta_cap filter, unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping this to plugin-specific capabilities. An authenticated attacker who controls the site's user ID 1 account — even one demoted to Subscriber, a common administrator-account hardening practice — can therefore pass every capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, gaining administrator-equivalent power, full site takeover, and remote code execution via the plugin and theme editors. On default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs, which explains the High attack-complexity CVSS 3.1 score of 7.5. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation is currently considered none known.

Do: Update Eventin to a version newer than 4.1.23 (the latest release) as soon as possible. If you use the 'demote user ID 1' hardening pattern, audit that account for signs of compromise and enforce a strong password plus two-factor authentication until patched. As a defense-in-depth measure against the plugin/theme editor RCE path, define DISALLOW_FILE_EDIT in wp-config.php.

The ThemeAtelier Domain For Sale plugin for WordPress before version 3.5.2 contains a missing authorization flaw (CWE-862) in its REST API endpoints, allowing unauthenticated attackers to reach protected resources without any credentials. The bug is triggered simply by sending crafted requests to the plugin's REST routes, which fail to verify user permissions. An attacker can retrieve stored offer records, delete arbitrary offers by numeric identifier, and pull dashboard statistics, exposing bidder contact information, offer details, private messages, verification tokens, and business data. Sites running any version prior to 3.5.2 with the plugin active are affected. No public proof-of-concept is known and the flaw does not appear in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Update Domain For Sale to version 3.5.2 or later immediately. Until patched, block unauthenticated access to the plugin's REST API namespace at the WAF or reverse proxy, and verify that REST permission callbacks are enforced. Afterward, audit offer records for unauthorized deletions or tampering, rotate any exposed verification tokens, and notify affected bidders if contact details or messages were disclosed.

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager plugin through 1.4.8.3 fail to check a capability, a nonce, or the type of record when processing a playlist-entry removal request, so the code permanently deletes whatever post ID the request identifies. Any unauthenticated attacker who can reach the affected site can send a crafted request to destroy arbitrary posts, pages, and media attachments, bypassing the WordPress trash so the content is unrecoverable without backups. The result is high-impact integrity loss (CVSS 3.1: 7.5, network vector, no privileges or user interaction required) but no confidentiality impact. Sites running these niche event/DJ-management plugins are affected. No public proof of concept or in-the-wild exploitation is known, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update MDJM Event Management to version 1.7.8.5 or later and Mobile Events Manager to a version newer than 1.4.8.3, or deactivate the plugin entirely if no fixed release is available for your version line. If patching must be delayed, use a WAF or firewall rule to block unauthenticated requests to the plugin's playlist-entry-removal AJAX/action endpoint. Because deletion bypasses the trash, verify working backups and audit the site for unexplained missing posts, pages, or media attachments.

The YouTube Embed WordPress plugin versions 10.0 to 10.3 performs no authorisation check on one of its AJAX actions, with its only safeguard being a nonce that is printed on every front-end page, so any unauthenticated visitor can retrieve the nonce and invoke the action. Because the plugin also fails to escape stored data before rendering it, an attacker can persist arbitrary web scripts that execute in the browser of any user viewing the affected content, including administrators, enabling session hijacking and full site takeover. Any WordPress site running the plugin in the 10.0–10.3 range is affected. There is no known public PoC and the flaw is not listed in CISA's KEV, so exploitation is currently none known.

Do: Update to version 10.4 or later (or the latest release) immediately. Inspect the plugin's stored options and rendered embed content for injected scripts and log out/rotate admin sessions if tampering is found. If updating is not possible, deactivate and remove the plugin and review server logs for unauthenticated AJAX requests to the affected action.

The Hoo Companion WordPress plugin, version 1.0.2, performs no authorisation, validation, or sanitisation on one of its import features, which writes submitted data directly into the active theme's settings. An unauthenticated attacker can send a crafted request to this endpoint to inject arbitrary JavaScript that executes in the browsers of any site visitor, including administrators, enabling session hijacking and full site takeover. The same malicious request overwrites and destroys the site's existing theme settings, breaking the site's appearance and configuration. Any WordPress site running the plugin alongside its companion theme is affected. There is no known public proof of concept and no evidence of in-the-wild exploitation at this time.

Do: Remove or deactivate the Hoo Companion plugin until a patched version newer than 1.0.2 is available, and check the plugin's repository for security advisories. Inspect the active theme's settings for unexpected or foreign scripts and restore them from a known-good backup, since exploitation wipes legitimate settings. Review administrator accounts and sessions for compromise, and use a WAF rule to block unauthenticated requests to the plugin's import endpoint if it must remain enabled.

The CryptoPayment Gateway WordPress plugin versions 1.2.1 and 1.2.2 fails to enforce an authorization (capability) check on one of its AJAX endpoints, which means any unauthenticated visitor can invoke what should be administrative-only operations. An attacker triggers the flaw simply by sending a crafted request to the unprotected AJAX action — no valid session, nonce, or credentials are required. Successful abuse lets the attacker delete arbitrary files on the server (potentially destroying the site or enabling a WordPress reinstallation takeover by wiping wp-config.php), overwrite the payment gateway configuration, and retrieve stored wallet credentials in cleartext, which could lead to direct theft of cryptocurrency funds. Sites running the plugin at versions 1.2.1–1.2.2 are affected regardless of configuration. There is no known public PoC and no evidence of in-the-wild exploitation to date, though the CVSS 10.0 rating and trivial preconditions make patching urgent.

Do: Update the CryptoPayment Gateway plugin immediately to the latest version (anything after 1.2.2, per the advisory's fixed-range). Treat all wallet credentials and API keys handled by the plugin as compromised: rotate wallets/seed phrases, review the gateway configuration for unauthorized changes, and verify site files for unexpected deletions or modifications (including restoring from backup if wp-config.php was targeted). Until patched, block unauthenticated AJAX requests to the plugin's endpoints via WAF rules or disable the plugin.

The GenieWords WordPress plugin, versions 1.5.27 through 1.5.34, lacks authorization (capability and nonce) checks on several of its REST API and AJAX actions, which allows unauthenticated attackers to invoke those endpoints and overwrite the plugin's configuration. Because the plugin also decodes stored values before printing them, an attacker can inject arbitrary web scripts through the writable settings, resulting in persistent JavaScript that executes on every front-end page of the site. Successful exploitation (which requires a victim to load an affected page, per the UI:R in the CVSS vector) can lead to session theft, administrative action hijacking, and site-wide content manipulation, reflected in the high 8.8 CVSS score. Any site running GenieWords 1.5.27–1.5.34 with the plugin active is affected. No public proof-of-concept is known and the flaw is not on the CISA KEV list, so no active exploitation has been confirmed.

Do: Update GenieWords to a version newer than 1.5.34 as soon as a patched release is available; if none exists yet, deactivate and remove the plugin. Until remediated, block or restrict unauthenticated access to the plugin's REST API (e.g., /wp-/geniewords/) and admin-ajax.php actions via a WAF rule. Review the plugin's stored configuration for unexpected changes or injected script payloads, and check site pages and logs for signs of malicious JavaScript or unauthorized settings modifications.

The Really Simple Security WordPress plugin before version 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor authentication enrolment, undermining the plugin's own second factor. An attacker who already knows a victim's password can trigger this reset, bypass email 2FA, and log in to obtain that user's session — up to administrator, enabling full site takeover. Any WordPress site running a version below 9.8.1, particularly those relying on the plugin's email-based two-factor authentication, is affected. The flaw carries a high CVSS 3.1 score of 7.5 and is classified as an authentication vulnerability (CWE-287). No public proof of concept exists, the issue is not on CISA's Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

Do: Upgrade Really Simple Security to version 9.8.1 or later immediately. Check user accounts for unexpected 2FA enrolment resets and review login/session logs for the vulnerable period, rotating credentials and invalidating sessions for administrator accounts if anything looks off. Because the attack requires prior knowledge of the password, enforce strong unique passwords and consider app-based (TOTP) second factors where available.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase and does not validate the payment method or the plan submitted with it, so any authenticated user — even a low-privileged subscriber — can claim a paid membership plan without paying. When a site owner has mapped a paid plan to a privileged WordPress role, this becomes privilege escalation, potentially granting full administrator access. The flaw (CWE-269, CVSS 3.1: 7.5 high) is triggered simply by submitting a crafted membership purchase request while logged in as any registered user. Affected sites are WordPress installations running the plugin below 5.2.8, particularly those that map purchasable plans to privileged roles. No public PoC is known, the CVE is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

Do: Update to User Registration & Membership 5.2.8 or later immediately. Review your membership-plan-to-role mappings and remove any that assign privileged roles (especially administrator) to purchasable plans. Audit users, role assignments, and payment records for accounts that received paid plans or role changes without a corresponding successful payment.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan, nor does it validate the plan a user attaches to their own account — a privilege-management flaw (CWE-269). An authenticated attacker with Author-level access or above can create or attach a membership plan that grants an arbitrary role, escalating their own account to Administrator. Successful exploitation effectively yields full site takeover, since an administrator can install plugins, modify all content, and access all site data. All sites running a version before 5.2.8 are affected, with multi-user sites where non-administrators hold authoring roles at greatest risk. No public proof of concept exists, the CVE is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: Update to User Registration & Membership 5.2.8 or later as soon as possible. Audit your user list for unexplained Administrator accounts or role changes, and review any membership plans created or edited by non-administrator users. Until patched, restrict plan-authoring and publishing capabilities to trusted users and monitor audit logs for suspicious role assignments.

The MemberPress Corporate Accounts plugin for WordPress contains a mass assignment flaw in its 'add_sub_account_user' function, which passes the raw 'userdata' array to 'wp_insert_user' without stripping dangerous keys such as 'role' or 'ID'. An authenticated attacker with subscriber-level access who holds a corporate account can exploit this over the network to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. Successful exploitation grants full site takeover, since the CVSS vector scores high impact to confidentiality, integrity, and availability. Any WordPress site running the plugin at version 1.5.39 or earlier is affected, though 1.5.39 only partially patched the issue. No public proof-of-concept or in-the-wild exploitation is currently known, and the flaw is not listed in CISA's KEV catalog.

Do: Update the Corporate Accounts plugin to the latest available release, verifying with MemberPress that the version you install fully remediates the flaw beyond the partial fix in 1.5.39. Audit the site for unexpected administrator accounts and recently changed admin email addresses, and review corporate account holders for suspicious activity. Until fully patched, consider temporarily deactivating the Corporate Accounts add-on or restricting corporate account creation.

The GEO my WP geolocation/mapping plugin for WordPress is vulnerable to an unauthenticated local file inclusion (CWE-98) in the gmw_posts_locator_ajax_info_window_loader function, affecting all versions up to and including 4.5.5.3. An unauthenticated attacker can send a crafted request to this function that causes the server to include and execute arbitrary .php files present on the host. This can be used to bypass access controls or obtain sensitive data, and becomes full remote code execution if the attacker can upload .php files that are then included, or in environments where PEAR is installed with register_argc_argv enabled. Any WordPress site running the plugin at version 4.5.5.3 or older is affected. As of now the flaw is not listed in CISA KEV and no public proof-of-concept is known.

Do: Update GEO my WP to the latest release available, i.e., any version newer than 4.5.5.3, as soon as possible. Until patched, use a WAF/firewall rule to block unauthenticated requests to the affected AJAX action and prevent upload of .php files to the server, and check server configurations (PEAR present with register_argc_argv enabled) where the flaw can escalate to full remote code execution. Review logs for anomalous calls to the info-window loader and for unexpected PHP file uploads.

Tutor LMS, a WordPress eLearning plugin, suffers from a PHP object injection flaw (CWE-502) in the `tutor_save_withdraw_account` AJAX handler, which accepts attacker-controlled `withdraw_method_field` values with no capability check beyond a nonce and stores them via `update_user_meta()` in a way that corrupts serialized string lengths. An authenticated user with subscriber-level privileges (or an unauthenticated attacker, if open user registration is enabled) who holds a valid nonce can therefore make `unserialize()` over-read into attacker-controlled bytes and inject an arbitrary serialized object. By chaining the plugin's bundled PayPal Composer autoloader with the `GuzzleHttp\Cookie\FileCookieJar` gadget, the attacker achieves remote code execution, writing attacker-controlled content to an attacker-specified filename on the server. All sites running Tutor LMS up to and including version 4.0.7 with the monetization feature enabled are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Update Tutor LMS to a release newer than 4.0.7 as soon as a patched version is published (no fixed version number is confirmed in the available data). As interim mitigation, disable the plugin's monetization/withdraw feature, restrict or close open user registration, and review `update_user_meta()`-stored withdraw account data for tampered serialized values. Sites that enabled monetization and registration should also audit for unexpected files written by web-server users during the exposure window.

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable to time-based blind SQL injection through the 'compare' parameter in all versions up to and including 4.7.11, caused by insufficient escaping and lack of prepared statements. Any unauthenticated attacker can trigger it by sending a crafted request to a public page that embeds an rtMedia shortcode (such as [rtmedia_gallery]) with the rtmedia_shortcode GET parameter set, since RTMediaQuery::query() merges $_REQUEST into the query while validating only top-level keys. Successful exploitation lets the attacker append additional SQL queries and extract sensitive information from the site's WordPress database, including potentially user credentials. Any WordPress site running the plugin with a rtMedia shortcode on a publicly reachable page is affected. As of now there is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update the rtMedia plugin to the newest release (any version newer than 4.7.11). Until patched, remove rtMedia shortcodes from public pages or use a WAF rule to block requests where the rtmedia_shortcode GET parameter is present along with nested 'compare' values. Review web server and WAF logs for requests containing the rtmedia_shortcode parameter, and check the database for signs of unexpected queries or data exfiltration.

The YayPricing WordPress plugin before version 3.5.7 fails to enforce an authorization check on a REST route that saves pricing rules, so any authenticated user with the subscriber role or above can write content into those rules. An attacker can embed JavaScript in a saved pricing rule, which then executes in the browser of an administrator who opens the plugin's settings page, making this a stored (persistent) cross-site scripting flaw. Because the script runs in the administrator's session, successful exploitation allows a low-privileged attacker to hijack admin access and fully compromise the site (for example, installing plugins or creating new administrators), consistent with the CVSS 3.1 score of 8.0 (high). Affected sites are those running YayPricing before 3.5.7, particularly WooCommerce stores with open user registration or other untrusted low-privileged accounts. No public proof of concept is known and the flaw is not on CISA's KEV list, so there is currently no evidence of exploitation in the wild.

Do: Update YayPricing to version 3.5.7 or later, which adds the missing authorization check on the affected REST route. Until patched, disable open user registration and audit existing subscriber-and-above accounts, since any authenticated user can inject the payload. Review saved pricing rules for unexpected JavaScript or unfamiliar entries (these execute when an admin opens the settings page) and check for signs of admin session hijacking or newly created administrator accounts.

The Zonify WordPress plugin before version 1.0.5 fails to perform any capability or authentication check on the functionality that returns the site's stored account login token. An unauthenticated remote attacker can send a request to the affected endpoint and directly receive the token the site uses to connect to the owner's linked service account. With that token, the attacker can authenticate to the linked service as the site owner, gaining access to that connected account (CVSS 3.1: 7.5, high confidentiality impact with no privileges or user interaction required). Any WordPress site running Zonify prior to 1.0.5 is affected. The flaw is not in CISA's KEV catalog and there is no known public proof of concept or observed exploitation to date.

Do: Upgrade Zonify to version 1.0.5 or later immediately. Because the stored token could already have been harvested, re-authorize the plugin to revoke and replace the linked service token, and review the linked account for unauthorized sessions or activity. If the plugin is no longer needed, remove it entirely, and check access logs for unauthenticated requests hitting the plugin's endpoints.

The Add User Autocomplete plugin for WordPress, in versions before 1.2, creates pending site-membership invitations without performing any capability check or CSRF nonce verification, and it honors a caller-supplied role for that invitation. As a result, any authenticated user — even one holding only the low-privileged Subscriber role — can send a crafted request to the invitation action, granting an account of their choosing (typically their own) the administrator role. Successful exploitation yields full administrative control of the affected site on a WordPress multisite network, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8, CWE-269 improper privilege management). Only multisite installations running the plugin below version 1.2 are exposed, and the attack is easiest where open registration lets attackers obtain a Subscriber account. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

Do: Upgrade to Add User Autocomplete 1.2 or later, which adds the missing capability and nonce checks. If updating is not immediately possible, deactivate the plugin on multisite networks, and audit pending site-membership invitations and user role lists for unexplained administrator accounts. Restricting open registration or minimizing low-privileged Subscriber accounts shrinks the pool of attackers who can trigger the flaw.

The WP Component WordPress plugin through version 2.2.4 exposes an action to unauthenticated users that has no capability or nonce checks, and it takes both the option name and the option value directly from the request. This allows any unauthenticated attacker to overwrite arbitrary WordPress site options by sending a single crafted HTTP request. On single-site installations this leads to a full takeover, since the attacker can enable user registration with a default role of administrator and then create an administrator account. Any site running the plugin at or including version 2.2.4 is affected, and the advisory does not specify a fixed version. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the CVE is not on CISA's KEV list.

Do: Upgrade WP Component to a version later than 2.2.4 as soon as a patched release is available, or remove the plugin entirely if no fix is forthcoming. Inspect the site's options for tampering — particularly 'users_can_register' enabled and 'default_role' set to administrator — and audit the users list for unauthorized administrator accounts. Review access logs for unauthenticated POST requests hitting the plugin's option-writing action endpoint.

The piclect WordPress plugin through version 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory. An unauthenticated attacker can simply send a crafted file (for example, a PHP webshell) to the plugin's upload endpoint and then reach it via its public URL, achieving arbitrary code execution and full server compromise. Any site running piclect through 1.0 with the plugin active is affected, and the flaw requires no authentication, user interaction, or privileges (CVSS 9.8). There is no known public PoC and the issue is not in the CISA KEV catalog, so exploitation status is currently none known, though the attack itself is trivial to reproduce. Defenders should treat any site running this plugin as potentially compromised.

Do: There is no indicated patched version, so remove or disable the piclect plugin entirely until a fixed release is available. Immediately inspect the plugin's public upload directory and the webserver for unexpected files (especially .php or .phtml shells) and rotate credentials/keys if any are found. As an interim control, block unauthenticated POST requests to the plugin's upload endpoint at the WAF or reverse proxy.

The wpstorecart WordPress plugin, through version 5.0.7, does not prevent direct, unauthenticated access to a bundled add-on that deserializes attacker-supplied input without restricting the permitted PHP classes. A remote, unauthenticated attacker can send a crafted serialized payload to this add-on and inject arbitrary PHP objects into the application. The injected objects can be escalated — potentially to remote code execution, data theft, or site takeover — when a suitable gadget chain (e.g., from another installed plugin or theme) is present on the site, which is why the CVSS attack complexity is rated high. Any WordPress site running wpstorecart 5.0.7 or earlier is affected, with no privileges or user interaction required to trigger the flaw. No public proof of concept is known, the CVE is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

Do: Because the advisory identifies no fixed version, the safest action is to deactivate and remove wpstorecart (5.0.7 or earlier) from any site still running it and migrate to a actively maintained e-commerce plugin. If removal must be delayed, block direct, unauthenticated HTTP requests to the bundled add-on via a WAF or server-level rule. Operators should also audit affected sites for signs of compromise such as unexpected administrator accounts, modified plugin or theme files, and unknown scheduled tasks.

The Album Cover Finder WordPress plugin through version 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, creating an unauthenticated SQL injection flaw. A remote attacker triggers it by sending a crafted request to the plugin's affected endpoint — no account, privileges, or user interaction are required. Successful exploitation lets the attacker read sensitive data from the WordPress database (the CVSS 3.1 score of 8.6 reflects high confidentiality impact across a changed scope), while integrity and availability are not directly affected per the scoring. Any site running the plugin at or below version 0.7.0 is affected. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: No patched version is identified in the data (0.7.0 appears to be the latest release), so the safest action is to deactivate and remove the plugin from any site where it is not essential. If it must remain, apply a WAF or virtual-patching rule that blocks SQL-injection patterns against the plugin's endpoints and review database and access logs for anomalous queries. Because injected queries can expose user tables and password hashes, consider rotating database credentials and forcing password resets for privileged accounts on affected sites.

The Masteriyo LMS WordPress plugin before 3.4.1 deserializes user-supplied metadata without validation when it is read back (CWE-502), enabling classic PHP object injection. An attacker holding even a minimal WordPress account (for example a subscriber created through open registration) can inject arbitrary PHP objects and, by abusing a gadget class bundled with the plugin's libraries, write and execute arbitrary code on the server. A weaker unauthenticated variant of the same flaw lets attackers with no account at all perform an arbitrary file write. The issue is rated critical at CVSS 3.1 9.9 with high impact on confidentiality, integrity, and availability, and affects all installations running versions before 3.4.1. The flaw was assigned via WPScan; no public proof of concept or in-the-wild exploitation is currently known.

Do: Upgrade Masteriyo LMS to version 3.4.1 or later immediately, since both the authenticated RCE and the unauthenticated file-write paths are fixed there. If your site allows open self-registration, review recently created low-privilege (subscriber) accounts for suspicious signups and consider temporarily disabling registration. Audit the server for unexpected files under the web root, webshells, or newly added administrator users, and verify the integrity of wp-content and your backups.

The BE REST Endpoints WordPress plugin through version 1.0.0 exposes REST endpoints for reading, creating, updating, and deleting widgets without performing any authorization check, allowing unauthenticated remote attackers to call them directly. Because the plugin also fails to sanitize the values stored in those widgets, an attacker can inject arbitrary JavaScript that executes in the browser of any user visiting the site. Successful exploitation yields stored cross-site scripting, which can be leveraged to hijack administrator sessions, perform actions as the victim, deface content, or redirect users to malicious sites. Any WordPress site running this plugin at or before version 1.0.0 is affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

Do: Remove the plugin if it is not needed, since all versions through 1.0.0 are affected and no fixed version is indicated in the data. Until the developer releases a patch, block unauthenticated access to the plugin's REST endpoints (e.g., via a WAF rule or by disabling the plugin) and inspect existing widgets for unexpected scripts or injected content. Review server logs for unauthenticated REST calls targeting the plugin's widget routes, and if compromise is suspected, rotate administrator credentials and invalidate active sessions.

The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 fails to implement CSRF protections on its template-import feature and does not sanitize imported data before storing and echoing it back. An attacker can trick a logged-in administrator into importing a maliciously crafted template via a forged request (e.g., through a link or embedded image on a site the admin visits). Because the malicious content is stored and rendered in the administrator's session, the attacker gains the ability to execute arbitrary JavaScript with admin privileges, which can be leveraged for site takeover, malicious admin creation, or further payload injection. Any WordPress site running this plugin at or below version 1.0.2 with an active administrator is affected. No public proof-of-concept or observed in-the-wild exploitation is known at this time, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: No fixed version is indicated in the available data, so treat all versions through 1.0.2 as vulnerable; disable and remove the plugin if the template export/import functionality is not essential. If the functionality is required, restrict access to trusted administrators only, audit previously imported templates for unexpected script content, and check WordPress user lists for recently created rogue admin accounts. As a general defense, administrators should avoid visiting untrusted sites while logged in, since the attack requires a forged request from the admin's browser.

The DS Ad Rotator WordPress plugin through version 0.8 exposes an image upload handler that performs no capability check, nonce verification, or file-type validation. Any unauthenticated attacker can send a crafted upload request directly to the vulnerable endpoint and write arbitrary files — including PHP scripts — into a web-accessible directory, where they can be executed to obtain remote code execution. Successful exploitation gives the attacker full control of the affected site and its underlying server, including data theft, defacement, and further pivoting. All sites running DS Ad Rotator 0.8 or earlier are affected, and no fixed version has been released. No public proof of concept is known and the flaw is not on CISA's KEV list, but exploitation is trivial for anyone who locates the endpoint, so exposure should be treated as immediately dangerous.

Do: No patched release exists (every version through 0.8 is vulnerable), so deactivate and delete DS Ad Rotator and replace it with a maintained ad-rotation plugin. In the interim, block or restrict access to the plugin's upload endpoint via a WAF or web-server rule. Audit the plugin's upload directory and the site for unexpected .php files or recently modified files that could indicate a planted webshell; if any are found, assume full compromise and rotate all credentials, database keys, and salts.

The Gpx2Graphics WordPress plugin through version 0.3 does not perform a CSRF check when handling file uploads and does not validate the type of the uploaded file. An attacker can craft a malicious page or link that, when opened by a logged-in administrator, silently uploads an arbitrary file such as a PHP webshell to the site. Because the uploaded PHP file can be executed on the server, this results in remote code execution and complete site takeover. Any WordPress site running Gpx2Graphics version 0.3 or earlier is affected. The flaw is rated high (CVSS 3.1: 7.2), is not on CISA's KEV list, and no public proof-of-concept or in-the-wild exploitation has been reported.

Do: Deactivate and remove Gpx2Graphics if it is not needed, since the disclosure indicates every version through 0.3 is vulnerable and no patched version is specified. If it must remain, restrict who can reach the plugin's upload handling and audit the server (especially wp-content/uploads and any plugin upload directories) for unexpected PHP files or webshells, reviewing logs for suspicious upload activity. Rotate credentials if any sign of compromise is found.

The Yogeta WP Cloud WordPress plugin through version 1.0 fails to validate a user-supplied file path before passing it to a file-read function on a public endpoint that has no authorization check. This allows an unauthenticated remote attacker to craft a request referencing an arbitrary path and download any file readable by the web server, including files containing sensitive credentials such as wp-config.php. Successful exploitation can expose database credentials, salts, and secrets, effectively enabling full site compromise. Any site running the plugin at version 1.0 or earlier is affected. The flaw is not in CISA's KEV, and no public PoC or observed exploitation is known at this time.

Do: No patched version is indicated in the data, so the safest action is to deactivate and remove the Yogeta WP Cloud plugin until a fix is released; if removal is not immediately possible, block external access to its public endpoint using WAF or firewall rules. Because credential files such as wp-config.php are readable, rotate database passwords, salts, and any API keys stored on the server. Review web and access logs for unauthenticated file-download requests targeting the plugin's endpoint.

The SAMO Forms WordPress plugin through version 1.0.0 does not properly sanitize and escape user-supplied input before using it in SQL queries across several unauthenticated actions, meaning the vulnerable endpoints are reachable by any remote visitor without an account or login. An unauthenticated attacker can send crafted requests to inject arbitrary SQL, and the CVSS 3.1 score of 8.6 (with high confidentiality impact and changed scope) indicates the attacker can read sensitive database contents, potentially including form submissions, user data, and data from other tables or components reachable by the site's database user. Integrity and availability are rated as not impacted. Any WordPress site running SAMO Forms 1.0.0 or earlier is affected. No public proof-of-concept is known and the flaw is not on CISA's KEV list, but unauthenticated SQL injection in WordPress plugins is frequently weaponized once details circulate, so this should be treated as patch-urgently rather than monitored passively.

Do: Check whether the developer has released a SAMO Forms version above 1.0.0 and upgrade immediately if so; the advisory specifies no patched version, so if no fix exists, deactivate and remove the plugin and migrate to a actively maintained form plugin. Audit web-server and database logs for anomalous queries, and verify that stored form-submission data (often containing PII) has not been accessed or exfiltrated. As an interim measure, a WAF with SQL injection signatures can block exploit attempts if the plugin cannot be removed right away.

The Temporary Login Without Password WordPress plugin before 1.9.9 fails to verify that the user requesting a temporary login holds network super admin rights before granting the new temporary account those rights. On a multisite network, an administrator of a single site can trigger this through the plugin's normal temporary-login creation flow and receive a temporary account with super admin privileges, escalating from control of one site to takeover of the entire network. The same missing check also allows an existing account, including the attacker's own, to be promoted. Any multisite installation running a version before 1.9.9 where site administrators can use the plugin is affected. No public proof of concept is known and the flaw is not on CISA's KEV list, so exploitation is currently none known.

Do: Upgrade to Temporary Login Without Password 1.9.9 or later immediately. On multisite networks, network-deactivate the plugin or otherwise prevent single-site administrators from creating temporary logins, then audit the super admin user list and any existing temporary logins for unexpected accounts or promotions. Review activity logs for temporary-login creations initiated by non-super-admin users and revoke any sessions they created.

The Booking for Appointments and Events Calendar (Amelia) WordPress plugin before 2.4.10 does not verify that a user editing a customer or employee record is entitled to modify the WordPress account linked to that record (CWE-639, authorization bypass through user-controlled key). An attacker who already holds Amelia's customer or employee management permissions can abuse the plugin's record-editing functionality to set the password and email address of other users' WordPress accounts, including potentially administrators, resulting in full account takeover. Sites running the plugin before 2.4.10 are affected, with practical risk concentrated on installations where those Amelia management permissions are granted to non-admin or otherwise untrusted users. The flaw is rated high severity (CVSS 3.1: 7.2) but requires high privileges to trigger; no public PoC exists and no exploitation in the wild has been reported.

Do: Upgrade the Amelia plugin to version 2.4.10 or later immediately. Review which user roles hold Amelia's customer/employee management capabilities and strip those permissions from untrusted users, since the flaw is only triggerable by someone with those permissions. Audit user accounts for unexplained password or email changes, reset credentials for any affected or high-value accounts, and check for newly created or elevated administrator accounts.

The WebTotem Backups WordPress plugin through version 1.0.1 contains a chained flaw in its file-deletion function: it does not validate the user-supplied file path, does not verify the requesting user's capabilities, and discards the result of its own CSRF check. As a result, any authenticated user — even a low-privilege role such as subscriber — can submit the plugin's request with a crafted path and delete arbitrary files on the web server. Arbitrary file deletion on WordPress can enable full site takeover, for example by deleting wp-config.php to force the site back into its installation routine and reclaim it. All sites running the plugin through version 1.0.1 are affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no indication of active exploitation.

Do: Update the plugin if a release newer than 1.0.1 is available; if no fixed version exists, deactivate and delete WebTotem Backups and switch to an alternative backup solution. Audit file systems and logs for unexplained deletions — particularly wp-config.php, .htaccess, and index.php — and check whether the site was forced into a reinstall or otherwise tampered with. Additionally, review subscriber and other low-privilege accounts for unauthorized registrations, and consider a WAF rule blocking the plugin's file-deletion endpoint.

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 deletes a user-supplied file without validating the path or checking the requesting user's capabilities (CWE-73). This means any authenticated user — even a low-privileged subscriber — can supply a crafted file path, including paths outside the plugin's intended directory, and delete arbitrary files on the server. By removing critical files such as wp-config.php or .htaccess, an attacker can trigger a WordPress reinstallation/reconfiguration flow and ultimately take over the site, reflecting the critical 9.6 CVSS score with high integrity and availability impact. Sites running the plugin at or below 1.0.1, especially those with open registration or many subscriber-level accounts, are the most exposed. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

Do: Update to a version newer than 1.0.1 if the developer has released a fix; if no patched version exists, deactivate and delete the plugin. Restrict self-registration and review user lists for unexpected subscriber accounts, and verify server integrity by checking for missing or tampered core files (e.g., wp-config.php, index.php, .htaccess), restoring from a clean backup if any are found.

The Frontegg SAML SSO WordPress plugin through version 1.0.1 does not verify the cryptographic signature or issuer of SAML authentication responses before establishing a login session (CWE-287, improper authentication). An unauthenticated remote attacker can craft a forged SAML response for the target site and submit it to the plugin's SSO endpoint, which accepts it without any validation. This lets the attacker log in as any existing user — including administrators — and create arbitrary new accounts, resulting in complete site takeover (CVSS 3.1: 9.8, critical). Any WordPress site running this plugin at version 1.0.1 or earlier with SAML SSO in use is affected. No public proof of concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Upgrade to a patched release above 1.0.1 as soon as one is available (monitor WPScan and the WordPress.org plugin page); until then, disable or remove the plugin and use an alternative SAML SSO solution, or restrict access to the plugin's SAML assertion endpoint at the firewall/WAF. Inspect user lists and authentication logs for unexpected accounts or admin logins, delete any rogue accounts, and reset credentials for all privileged users.

CVE-2026-62112 is an SQL injection (CWE-89) in the Amelia booking plugin for WordPress, affecting all versions up to and including 2.4.9. It is described as an 'Editor' SQL injection, and the CVSS vector indicates the attack requires a highly privileged authenticated user (PR:H) over the network with no user interaction. A successful injection could expose sensitive data from the site's database (confidentiality impact rated high), with limited availability impact. Any WordPress site running Amelia at or below version 2.4.9 is affected. Exploitation is not currently known: the flaw is not in CISA's KEV and no public proof-of-concept exists; the issue was identified by Patchstack's audit team.

Do: Update Amelia to the latest available release (any version newer than 2.4.9). Until patched, limit and audit high-privilege accounts (administrators/editors) on sites running Amelia, and review logs for anomalous database queries. No public exploit exists yet, but monitor vendor and Patchstack advisories for the fixed version and any emerging PoCs.

CVE-2026-62109 is a SQL injection flaw (CWE-89) in the editor-facing functionality of the Sky Addons for Elementor WordPress plugin, affecting all versions up to and including 3.8.4. It is triggered over the network by an authenticated user with high privileges (administrator-level per the CVSS PR:High metric), with low attack complexity and no user interaction required. Because WordPress plugins query the site's shared database, a successful injection exposes sensitive database contents such as user credentials and password hashes (high confidentiality impact), with only low availability impact. Any WordPress site running the plugin at or below version 3.8.4 is affected; the plugin is an addon for the Elementor page builder, so only Elementor-based sites using this addon are in scope. There is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation has been reported so far.

Do: Update Sky Addons for Elementor to the latest patched release (any version newer than 3.8.4) as soon as it is available in the WordPress plugin directory. Until then, audit and limit administrator accounts, since only high-privileged users can trigger the injection, and review logs for unexpected administrator activity or anomalous database queries. No workaround is documented in the available data.

CVE-2026-62107 is an unauthenticated PHP object injection vulnerability (CWE-502, deserialization of untrusted data) in the free Masteriyo LMS WordPress plugin, affecting all versions up to and including 3.4.0. An attacker can trigger it by sending a crafted request containing maliciously serialized PHP data to a plugin endpoint that unserializes untrusted input, without needing any login or privileges. Successful injection can let the attacker manipulate PHP objects, which may enable arbitrary code execution, data modification, or information disclosure depending on the gadget chains available on the site; the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact. Any WordPress site running Masteriyo LMS 3.4.0 or earlier is affected. No public proof of concept, in-the-wild exploitation, or CISA KEV listing is known at this time.

Do: Upgrade Masteriyo LMS to a release newer than 3.4.0 as soon as the vendor's fix is published, and check the Patchstack advisory or plugin changelog for the exact fixed version number. Until patched, deactivate the plugin or restrict unauthenticated public access to it on internet-facing sites, since no login is required to trigger the flaw. No public PoC or in-the-wild exploitation is currently known, but monitor the advisory for updates and treat any exposed vulnerable site as potentially reachable by attackers once details emerge.

CVE-2026-62106 is an incorrect privilege-assignment flaw (CWE-266) in the WordPress plugin SMS Alert Order Notifications, affecting every version up to and including 3.9.9. A user holding only a subscriber-level account can send a crafted authenticated request to the plugin's inadequately protected routine and have their account's role or capabilities elevated, typically to administrator. That grants effectively full control of the affected site (reading or modifying data, changing settings, installing or editing plugins), consistent with the 8.8 high CVSS score with high confidentiality, integrity and availability impacts. Affected sites are WordPress installations, generally WooCommerce stores using the plugin for SMS order notifications, particularly where an attacker can obtain or self-register a subscriber account. As of this report there is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation in the wild is known; remediation is to update to a release newer than 3.9.9.

Do: Update SMS Alert Order Notifications to the latest available release (anything newer than 3.9.9). Until patched, reduce exposure by disabling or restricting open subscriber registration and review low-privileged accounts and any recent role changes for signs of tampering. Because exploitation requires a subscriber-level account, sites that do not allow self-registration face materially lower risk.

CVE-2026-62105 is an unauthenticated PHP object injection flaw (CWE-502, deserialization of untrusted data) in the ThemeREX Addons plugin for WordPress, affecting all versions below 2.45.0. Because the vulnerable deserialization path is reachable over the network without authentication, privileges, or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N), any remote attacker can send a crafted serialized PHP payload to trigger it. Successful object injection can leverage PHP object chains in WordPress for high-impact outcomes such as arbitrary code execution, database manipulation, or file operations (CVSS 3.1 C:H/I:H/A:H), potentially leading to full site compromise. WordPress sites running ThemeREX Addons prior to 2.45.0 are affected, including sites where the plugin was installed automatically as a companion to a ThemeREX commercial theme rather than chosen by the site owner. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Update ThemeREX Addons to version 2.45.0 or later, checking the plugin list even on sites where it was installed automatically with a bundled ThemeREX theme. If immediate patching is not possible, apply WAF rules that restrict unauthenticated requests to the plugin's endpoints and review logs for unexpected admin users, modified files, or unusual serialized input. No public PoC or known exploitation is currently reported, but treat this critical (9.8) issue as a priority patch.

CVE-2026-62103 is an unauthenticated PHP object injection vulnerability in the Everest Forms WordPress plugin, caused by deserialization of untrusted data (CWE-502). An attacker who can reach the affected code path without logging in can supply crafted serialized values, causing the plugin to instantiate arbitrary PHP objects. Depending on the object classes (gadget chains) present in a site's installed plugins, this can escalate to arbitrary file deletion, data modification, and potentially remote code execution, consistent with the assigned critical 9.8 CVSS score. All WordPress sites running Everest Forms version 3.6.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there is no confirmed exploitation in the wild at this time.

Do: Update Everest Forms to the latest available release (any version above 3.6.0) on all WordPress sites, prioritizing internet-facing sites given the unauthenticated, network-exploitable nature of the flaw. If patching must be delayed, deactivate the plugin as a stopgap and review web server and WordPress logs for suspicious unauthenticated requests or signs of object-injection abuse.

CVE-2026-62102 is a privilege escalation flaw (CWE-266) in the Gato GraphQL plugin for WordPress that lets an authenticated user with Subscriber-level privileges elevate their account to higher privileges, most likely administrator. It is triggered over the web through the plugin's exposed GraphQL API, requiring only a low-privileged account (PR:L) and no user interaction, which is reflected in the 8.8 High CVSS 3.1 score. A successful attacker gains high-impact control over the site, consistent with administrator-level access to content, settings, and data. Any WordPress installation running Gato GraphQL version 19.2.3 or earlier is affected, with the greatest exposure on sites that permit subscriber registrations or have other subscriber-level accounts. As of this analysis there is no public proof-of-concept, the issue is not listed in CISA KEV, and no in-the-wild exploitation has been reported.

Do: Update Gato GraphQL on every affected site to a release newer than 19.2.3, checking the plugin's changelog for the patched version. Until patched, consider deactivating the plugin if it is not required or restricting access to the GraphQL endpoint, and audit user accounts for unexpected administrator-level users (a sign of prior privilege escalation). Sites with registration closed and no subscriber-level accounts face reduced risk because exploitation requires an authenticated low-privileged user.

CVE-2026-62089 is a missing authorization flaw (CWE-862) in the Pixar Labs 'Master Addons for Elementor' WordPress plugin, meaning one or more of its routines fail to verify a user's capabilities before executing privileged actions. Because the flaw requires low privileges (CVSS PR:L), an attacker needs an account on the target site — even a low-level role such as subscriber — and can then send a crafted network request to trigger the unprotected function. Successful abuse lets a minimally privileged user perform privileged operations, with the published CVSS score (7.1 high) weighting the impact toward integrity changes and potentially high availability impact rather than data disclosure. Any WordPress site running Master Addons for Elementor version 3.2.2 or earlier is affected. There is no evidence of exploitation so far: the flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

Do: Update Master Addons for Elementor to the latest patched release (any version newer than 3.2.2; check the WordPress.org plugin page or changelog for the current fixed version, as none is specified in the advisory). Until patched, review accounts with low-privilege roles and consider restricting unknown registered users, and verify logged-in-user activity for signs of unauthorized privileged actions. Admins of Elementor-based sites should confirm their installed plugin version in the WordPress dashboard.

CVE-2026-17037 is a stored cross-site scripting (XSS, CWE-79) vulnerability in the Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress, caused by insufficient input sanitization and output escaping of the 'comment' parameter. An unauthenticated attacker can submit a crafted 'comment' value that the plugin stores and later outputs without proper escaping, so the injected web script executes in the browser of any user who loads the affected page. Successful exploitation lets the attacker run arbitrary JavaScript in victims' browsers — for example stealing session cookies or performing actions in the context of logged-in users, including administrators — and the CVSS 3.1 score of 7.2 (High) with a changed scope reflects that users beyond the vulnerable component are impacted. All versions of the plugin up to and including 6.2.0 are affected on any WordPress site where the plugin is active. As of this analysis there is no public proof-of-concept, no confirmed in-the-wild exploitation, and the issue is not in CISA's KEV; the CVE was assigned by Wordfence, the WordPress ecosystem CNA.

Do: Update the plugin to a patched release newer than 6.2.0 as soon as one is available, since all versions through 6.2.0 are affected. Until then, deploy a WAF or virtual-patching rule that strips HTML/script tags and event-handler attributes from 'comment' parameters, and audit recently saved content and comments for injected script payloads. Sites that do not rely on the plugin's form/comment functionality can deactivate the plugin as an interim mitigation.

The Gutenverse News WordPress plugin before 3.3.3 adds extra HTML elements to WordPress's global sanitization allowlist (KSES) without scoping them to its own intended context, so the relaxed list applies to every sanitization path on the site, including comments submitted by unauthenticated visitors. An attacker can therefore post a comment containing JavaScript-bearing HTML that passes WordPress's sanitization and is stored on the site. The injected script executes in the browser of any administrator who reviews the pending comment in the moderation queue, potentially allowing session hijacking and unauthorized admin actions, and also executes for any visitor who views the post after the comment is approved. Any WordPress site running the vulnerable plugin with unauthenticated comments enabled is affected. No public proof-of-concept, listing in CISA KEV, or confirmed in-the-wild exploitation is known at this time.

Do: Update Gutenverse News to version 3.3.3 or later as soon as possible. Until patched, consider disabling unauthenticated comments or disabling the plugin, and review the comment queue plus existing approved comments for HTML containing script or event-handler attributes; because admins who reviewed comments may already have been targeted, check for suspicious admin activity and rotate credentials if anything looks unusual.

The MultiVendorX WordPress plugin prior to 5.0.16 does not restrict which users can modify the plugin's role and capability settings, an improper privilege management flaw (CWE-269). A user holding the plugin's vendor role can reach those unprotected settings and grant the vendor role administrator-level capabilities. The next time that vendor acts with their role, they effectively hold administrator rights and can take over the site, including full read/write control and content or configuration changes. Any WordPress site running a MultiVendorX version before 5.0.16 is affected, especially multi-vendor marketplaces where several untrusted parties hold vendor accounts. There is no public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Update MultiVendorX to version 5.0.16 or later. If immediate upgrade is not possible, restrict and review who holds the vendor role and audit vendor accounts and role definitions for unexpectedly granted administrator-level capabilities, checking for any unauthorized admin users or capability changes.