Vulnerabilities

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.

The YayPricing WordPress plugin before version 3.5.7 fails to enforce an authorization check on a REST route that saves pricing rules, so any authenticated user with the subscriber role or above can write content into those rules. An attacker can embed JavaScript in a saved pricing rule, which then executes in the browser of an administrator who opens the plugin's settings page, making this a stored (persistent) cross-site scripting flaw. Because the script runs in the administrator's session, successful exploitation allows a low-privileged attacker to hijack admin access and fully compromise the site (for example, installing plugins or creating new administrators), consistent with the CVSS 3.1 score of 8.0 (high). Affected sites are those running YayPricing before 3.5.7, particularly WooCommerce stores with open user registration or other untrusted low-privileged accounts. No public proof of concept is known and the flaw is not on CISA's KEV list, so there is currently no evidence of exploitation in the wild.

Do: Update YayPricing to version 3.5.7 or later, which adds the missing authorization check on the affected REST route. Until patched, disable open user registration and audit existing subscriber-and-above accounts, since any authenticated user can inject the payload. Review saved pricing rules for unexpected JavaScript or unfamiliar entries (these execute when an admin opens the settings page) and check for signs of admin session hijacking or newly created administrator accounts.

The Zonify WordPress plugin before version 1.0.5 fails to perform any capability or authentication check on the functionality that returns the site's stored account login token. An unauthenticated remote attacker can send a request to the affected endpoint and directly receive the token the site uses to connect to the owner's linked service account. With that token, the attacker can authenticate to the linked service as the site owner, gaining access to that connected account (CVSS 3.1: 7.5, high confidentiality impact with no privileges or user interaction required). Any WordPress site running Zonify prior to 1.0.5 is affected. The flaw is not in CISA's KEV catalog and there is no known public proof of concept or observed exploitation to date.

Do: Upgrade Zonify to version 1.0.5 or later immediately. Because the stored token could already have been harvested, re-authorize the plugin to revoke and replace the linked service token, and review the linked account for unauthorized sessions or activity. If the plugin is no longer needed, remove it entirely, and check access logs for unauthenticated requests hitting the plugin's endpoints.

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

The Add User Autocomplete plugin for WordPress, in versions before 1.2, creates pending site-membership invitations without performing any capability check or CSRF nonce verification, and it honors a caller-supplied role for that invitation. As a result, any authenticated user — even one holding only the low-privileged Subscriber role — can send a crafted request to the invitation action, granting an account of their choosing (typically their own) the administrator role. Successful exploitation yields full administrative control of the affected site on a WordPress multisite network, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8, CWE-269 improper privilege management). Only multisite installations running the plugin below version 1.2 are exposed, and the attack is easiest where open registration lets attackers obtain a Subscriber account. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

Do: Upgrade to Add User Autocomplete 1.2 or later, which adds the missing capability and nonce checks. If updating is not immediately possible, deactivate the plugin on multisite networks, and audit pending site-membership invitations and user role lists for unexplained administrator accounts. Restricting open registration or minimizing low-privileged Subscriber accounts shrinks the pool of attackers who can trigger the flaw.

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The WP Component WordPress plugin through version 2.2.4 exposes an action to unauthenticated users that has no capability or nonce checks, and it takes both the option name and the option value directly from the request. This allows any unauthenticated attacker to overwrite arbitrary WordPress site options by sending a single crafted HTTP request. On single-site installations this leads to a full takeover, since the attacker can enable user registration with a default role of administrator and then create an administrator account. Any site running the plugin at or including version 2.2.4 is affected, and the advisory does not specify a fixed version. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the CVE is not on CISA's KEV list.

Do: Upgrade WP Component to a version later than 2.2.4 as soon as a patched release is available, or remove the plugin entirely if no fix is forthcoming. Inspect the site's options for tampering — particularly 'users_can_register' enabled and 'default_role' set to administrator — and audit the users list for unauthorized administrator accounts. Review access logs for unauthenticated POST requests hitting the plugin's option-writing action endpoint.

The piclect WordPress plugin through version 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory. An unauthenticated attacker can simply send a crafted file (for example, a PHP webshell) to the plugin's upload endpoint and then reach it via its public URL, achieving arbitrary code execution and full server compromise. Any site running piclect through 1.0 with the plugin active is affected, and the flaw requires no authentication, user interaction, or privileges (CVSS 9.8). There is no known public PoC and the issue is not in the CISA KEV catalog, so exploitation status is currently none known, though the attack itself is trivial to reproduce. Defenders should treat any site running this plugin as potentially compromised.

Do: There is no indicated patched version, so remove or disable the piclect plugin entirely until a fixed release is available. Immediately inspect the plugin's public upload directory and the webserver for unexpected files (especially .php or .phtml shells) and rotate credentials/keys if any are found. As an interim control, block unauthenticated POST requests to the plugin's upload endpoint at the WAF or reverse proxy.

The wpstorecart WordPress plugin, through version 5.0.7, does not prevent direct, unauthenticated access to a bundled add-on that deserializes attacker-supplied input without restricting the permitted PHP classes. A remote, unauthenticated attacker can send a crafted serialized payload to this add-on and inject arbitrary PHP objects into the application. The injected objects can be escalated — potentially to remote code execution, data theft, or site takeover — when a suitable gadget chain (e.g., from another installed plugin or theme) is present on the site, which is why the CVSS attack complexity is rated high. Any WordPress site running wpstorecart 5.0.7 or earlier is affected, with no privileges or user interaction required to trigger the flaw. No public proof of concept is known, the CVE is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

Do: Because the advisory identifies no fixed version, the safest action is to deactivate and remove wpstorecart (5.0.7 or earlier) from any site still running it and migrate to a actively maintained e-commerce plugin. If removal must be delayed, block direct, unauthenticated HTTP requests to the bundled add-on via a WAF or server-level rule. Operators should also audit affected sites for signs of compromise such as unexpected administrator accounts, modified plugin or theme files, and unknown scheduled tasks.

The Album Cover Finder WordPress plugin through version 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, creating an unauthenticated SQL injection flaw. A remote attacker triggers it by sending a crafted request to the plugin's affected endpoint — no account, privileges, or user interaction are required. Successful exploitation lets the attacker read sensitive data from the WordPress database (the CVSS 3.1 score of 8.6 reflects high confidentiality impact across a changed scope), while integrity and availability are not directly affected per the scoring. Any site running the plugin at or below version 0.7.0 is affected. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

Do: No patched version is identified in the data (0.7.0 appears to be the latest release), so the safest action is to deactivate and remove the plugin from any site where it is not essential. If it must remain, apply a WAF or virtual-patching rule that blocks SQL-injection patterns against the plugin's endpoints and review database and access logs for anomalous queries. Because injected queries can expose user tables and password hashes, consider rotating database credentials and forcing password resets for privileged accounts on affected sites.

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.

The Masteriyo LMS WordPress plugin before 3.4.1 deserializes user-supplied metadata without validation when it is read back (CWE-502), enabling classic PHP object injection. An attacker holding even a minimal WordPress account (for example a subscriber created through open registration) can inject arbitrary PHP objects and, by abusing a gadget class bundled with the plugin's libraries, write and execute arbitrary code on the server. A weaker unauthenticated variant of the same flaw lets attackers with no account at all perform an arbitrary file write. The issue is rated critical at CVSS 3.1 9.9 with high impact on confidentiality, integrity, and availability, and affects all installations running versions before 3.4.1. The flaw was assigned via WPScan; no public proof of concept or in-the-wild exploitation is currently known.

Do: Upgrade Masteriyo LMS to version 3.4.1 or later immediately, since both the authenticated RCE and the unauthenticated file-write paths are fixed there. If your site allows open self-registration, review recently created low-privilege (subscriber) accounts for suspicious signups and consider temporarily disabling registration. Audit the server for unexpected files under the web root, webshells, or newly added administrator users, and verify the integrity of wp-content and your backups.

The BE REST Endpoints WordPress plugin through version 1.0.0 exposes REST endpoints for reading, creating, updating, and deleting widgets without performing any authorization check, allowing unauthenticated remote attackers to call them directly. Because the plugin also fails to sanitize the values stored in those widgets, an attacker can inject arbitrary JavaScript that executes in the browser of any user visiting the site. Successful exploitation yields stored cross-site scripting, which can be leveraged to hijack administrator sessions, perform actions as the victim, deface content, or redirect users to malicious sites. Any WordPress site running this plugin at or before version 1.0.0 is affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

Do: Remove the plugin if it is not needed, since all versions through 1.0.0 are affected and no fixed version is indicated in the data. Until the developer releases a patch, block unauthenticated access to the plugin's REST endpoints (e.g., via a WAF rule or by disabling the plugin) and inspect existing widgets for unexpected scripts or injected content. Review server logs for unauthenticated REST calls targeting the plugin's widget routes, and if compromise is suspected, rotate administrator credentials and invalidate active sessions.

The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 fails to implement CSRF protections on its template-import feature and does not sanitize imported data before storing and echoing it back. An attacker can trick a logged-in administrator into importing a maliciously crafted template via a forged request (e.g., through a link or embedded image on a site the admin visits). Because the malicious content is stored and rendered in the administrator's session, the attacker gains the ability to execute arbitrary JavaScript with admin privileges, which can be leveraged for site takeover, malicious admin creation, or further payload injection. Any WordPress site running this plugin at or below version 1.0.2 with an active administrator is affected. No public proof-of-concept or observed in-the-wild exploitation is known at this time, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: No fixed version is indicated in the available data, so treat all versions through 1.0.2 as vulnerable; disable and remove the plugin if the template export/import functionality is not essential. If the functionality is required, restrict access to trusted administrators only, audit previously imported templates for unexpected script content, and check WordPress user lists for recently created rogue admin accounts. As a general defense, administrators should avoid visiting untrusted sites while logged in, since the attack requires a forged request from the admin's browser.

The DS Ad Rotator WordPress plugin through version 0.8 exposes an image upload handler that performs no capability check, nonce verification, or file-type validation. Any unauthenticated attacker can send a crafted upload request directly to the vulnerable endpoint and write arbitrary files — including PHP scripts — into a web-accessible directory, where they can be executed to obtain remote code execution. Successful exploitation gives the attacker full control of the affected site and its underlying server, including data theft, defacement, and further pivoting. All sites running DS Ad Rotator 0.8 or earlier are affected, and no fixed version has been released. No public proof of concept is known and the flaw is not on CISA's KEV list, but exploitation is trivial for anyone who locates the endpoint, so exposure should be treated as immediately dangerous.

Do: No patched release exists (every version through 0.8 is vulnerable), so deactivate and delete DS Ad Rotator and replace it with a maintained ad-rotation plugin. In the interim, block or restrict access to the plugin's upload endpoint via a WAF or web-server rule. Audit the plugin's upload directory and the site for unexpected .php files or recently modified files that could indicate a planted webshell; if any are found, assume full compromise and rotate all credentials, database keys, and salts.

The Gpx2Graphics WordPress plugin through version 0.3 does not perform a CSRF check when handling file uploads and does not validate the type of the uploaded file. An attacker can craft a malicious page or link that, when opened by a logged-in administrator, silently uploads an arbitrary file such as a PHP webshell to the site. Because the uploaded PHP file can be executed on the server, this results in remote code execution and complete site takeover. Any WordPress site running Gpx2Graphics version 0.3 or earlier is affected. The flaw is rated high (CVSS 3.1: 7.2), is not on CISA's KEV list, and no public proof-of-concept or in-the-wild exploitation has been reported.

Do: Deactivate and remove Gpx2Graphics if it is not needed, since the disclosure indicates every version through 0.3 is vulnerable and no patched version is specified. If it must remain, restrict who can reach the plugin's upload handling and audit the server (especially wp-content/uploads and any plugin upload directories) for unexpected PHP files or webshells, reviewing logs for suspicious upload activity. Rotate credentials if any sign of compromise is found.

The Yogeta WP Cloud WordPress plugin through version 1.0 fails to validate a user-supplied file path before passing it to a file-read function on a public endpoint that has no authorization check. This allows an unauthenticated remote attacker to craft a request referencing an arbitrary path and download any file readable by the web server, including files containing sensitive credentials such as wp-config.php. Successful exploitation can expose database credentials, salts, and secrets, effectively enabling full site compromise. Any site running the plugin at version 1.0 or earlier is affected. The flaw is not in CISA's KEV, and no public PoC or observed exploitation is known at this time.

Do: No patched version is indicated in the data, so the safest action is to deactivate and remove the Yogeta WP Cloud plugin until a fix is released; if removal is not immediately possible, block external access to its public endpoint using WAF or firewall rules. Because credential files such as wp-config.php are readable, rotate database passwords, salts, and any API keys stored on the server. Review web and access logs for unauthenticated file-download requests targeting the plugin's endpoint.

The SAMO Forms WordPress plugin through version 1.0.0 does not properly sanitize and escape user-supplied input before using it in SQL queries across several unauthenticated actions, meaning the vulnerable endpoints are reachable by any remote visitor without an account or login. An unauthenticated attacker can send crafted requests to inject arbitrary SQL, and the CVSS 3.1 score of 8.6 (with high confidentiality impact and changed scope) indicates the attacker can read sensitive database contents, potentially including form submissions, user data, and data from other tables or components reachable by the site's database user. Integrity and availability are rated as not impacted. Any WordPress site running SAMO Forms 1.0.0 or earlier is affected. No public proof-of-concept is known and the flaw is not on CISA's KEV list, but unauthenticated SQL injection in WordPress plugins is frequently weaponized once details circulate, so this should be treated as patch-urgently rather than monitored passively.

Do: Check whether the developer has released a SAMO Forms version above 1.0.0 and upgrade immediately if so; the advisory specifies no patched version, so if no fix exists, deactivate and remove the plugin and migrate to a actively maintained form plugin. Audit web-server and database logs for anomalous queries, and verify that stored form-submission data (often containing PII) has not been accessed or exfiltrated. As an interim measure, a WAF with SQL injection signatures can block exploit attempts if the plugin cannot be removed right away.

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.

The Temporary Login Without Password WordPress plugin before 1.9.9 fails to verify that the user requesting a temporary login holds network super admin rights before granting the new temporary account those rights. On a multisite network, an administrator of a single site can trigger this through the plugin's normal temporary-login creation flow and receive a temporary account with super admin privileges, escalating from control of one site to takeover of the entire network. The same missing check also allows an existing account, including the attacker's own, to be promoted. Any multisite installation running a version before 1.9.9 where site administrators can use the plugin is affected. No public proof of concept is known and the flaw is not on CISA's KEV list, so exploitation is currently none known.

Do: Upgrade to Temporary Login Without Password 1.9.9 or later immediately. On multisite networks, network-deactivate the plugin or otherwise prevent single-site administrators from creating temporary logins, then audit the super admin user list and any existing temporary logins for unexpected accounts or promotions. Review activity logs for temporary-login creations initiated by non-super-admin users and revoke any sessions they created.

The Booking for Appointments and Events Calendar (Amelia) WordPress plugin before 2.4.10 does not verify that a user editing a customer or employee record is entitled to modify the WordPress account linked to that record (CWE-639, authorization bypass through user-controlled key). An attacker who already holds Amelia's customer or employee management permissions can abuse the plugin's record-editing functionality to set the password and email address of other users' WordPress accounts, including potentially administrators, resulting in full account takeover. Sites running the plugin before 2.4.10 are affected, with practical risk concentrated on installations where those Amelia management permissions are granted to non-admin or otherwise untrusted users. The flaw is rated high severity (CVSS 3.1: 7.2) but requires high privileges to trigger; no public PoC exists and no exploitation in the wild has been reported.

Do: Upgrade the Amelia plugin to version 2.4.10 or later immediately. Review which user roles hold Amelia's customer/employee management capabilities and strip those permissions from untrusted users, since the flaw is only triggerable by someone with those permissions. Audit user accounts for unexplained password or email changes, reset credentials for any affected or high-value accounts, and check for newly created or elevated administrator accounts.

The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

The WebTotem Backups WordPress plugin through version 1.0.1 contains a chained flaw in its file-deletion function: it does not validate the user-supplied file path, does not verify the requesting user's capabilities, and discards the result of its own CSRF check. As a result, any authenticated user — even a low-privilege role such as subscriber — can submit the plugin's request with a crafted path and delete arbitrary files on the web server. Arbitrary file deletion on WordPress can enable full site takeover, for example by deleting wp-config.php to force the site back into its installation routine and reclaim it. All sites running the plugin through version 1.0.1 are affected. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no indication of active exploitation.

Do: Update the plugin if a release newer than 1.0.1 is available; if no fixed version exists, deactivate and delete WebTotem Backups and switch to an alternative backup solution. Audit file systems and logs for unexplained deletions — particularly wp-config.php, .htaccess, and index.php — and check whether the site was forced into a reinstall or otherwise tampered with. Additionally, review subscriber and other low-privilege accounts for unauthorized registrations, and consider a WAF rule blocking the plugin's file-deletion endpoint.

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 deletes a user-supplied file without validating the path or checking the requesting user's capabilities (CWE-73). This means any authenticated user — even a low-privileged subscriber — can supply a crafted file path, including paths outside the plugin's intended directory, and delete arbitrary files on the server. By removing critical files such as wp-config.php or .htaccess, an attacker can trigger a WordPress reinstallation/reconfiguration flow and ultimately take over the site, reflecting the critical 9.6 CVSS score with high integrity and availability impact. Sites running the plugin at or below 1.0.1, especially those with open registration or many subscriber-level accounts, are the most exposed. No public proof of concept is known and the flaw is not in CISA's KEV catalog, so exploitation is currently assessed as none known.

Do: Update to a version newer than 1.0.1 if the developer has released a fix; if no patched version exists, deactivate and delete the plugin. Restrict self-registration and review user lists for unexpected subscriber accounts, and verify server integrity by checking for missing or tampered core files (e.g., wp-config.php, index.php, .htaccess), restoring from a clean backup if any are found.

The Frontegg SAML SSO WordPress plugin through version 1.0.1 does not verify the cryptographic signature or issuer of SAML authentication responses before establishing a login session (CWE-287, improper authentication). An unauthenticated remote attacker can craft a forged SAML response for the target site and submit it to the plugin's SSO endpoint, which accepts it without any validation. This lets the attacker log in as any existing user — including administrators — and create arbitrary new accounts, resulting in complete site takeover (CVSS 3.1: 9.8, critical). Any WordPress site running this plugin at version 1.0.1 or earlier with SAML SSO in use is affected. No public proof of concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Upgrade to a patched release above 1.0.1 as soon as one is available (monitor WPScan and the WordPress.org plugin page); until then, disable or remove the plugin and use an alternative SAML SSO solution, or restrict access to the plugin's SAML assertion endpoint at the firewall/WAF. Inspect user lists and authentication logs for unexpected accounts or admin logins, delete any rogue accounts, and reset credentials for all privileged users.

Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

CVE-2026-62112 is an SQL injection (CWE-89) in the Amelia booking plugin for WordPress, affecting all versions up to and including 2.4.9. It is described as an 'Editor' SQL injection, and the CVSS vector indicates the attack requires a highly privileged authenticated user (PR:H) over the network with no user interaction. A successful injection could expose sensitive data from the site's database (confidentiality impact rated high), with limited availability impact. Any WordPress site running Amelia at or below version 2.4.9 is affected. Exploitation is not currently known: the flaw is not in CISA's KEV and no public proof-of-concept exists; the issue was identified by Patchstack's audit team.

Do: Update Amelia to the latest available release (any version newer than 2.4.9). Until patched, limit and audit high-privilege accounts (administrators/editors) on sites running Amelia, and review logs for anomalous database queries. No public exploit exists yet, but monitor vendor and Patchstack advisories for the fixed version and any emerging PoCs.

Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.

Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

CVE-2026-62109 is a SQL injection flaw (CWE-89) in the editor-facing functionality of the Sky Addons for Elementor WordPress plugin, affecting all versions up to and including 3.8.4. It is triggered over the network by an authenticated user with high privileges (administrator-level per the CVSS PR:High metric), with low attack complexity and no user interaction required. Because WordPress plugins query the site's shared database, a successful injection exposes sensitive database contents such as user credentials and password hashes (high confidentiality impact), with only low availability impact. Any WordPress site running the plugin at or below version 3.8.4 is affected; the plugin is an addon for the Elementor page builder, so only Elementor-based sites using this addon are in scope. There is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation has been reported so far.

Do: Update Sky Addons for Elementor to the latest patched release (any version newer than 3.8.4) as soon as it is available in the WordPress plugin directory. Until then, audit and limit administrator accounts, since only high-privileged users can trigger the injection, and review logs for unexpected administrator activity or anomalous database queries. No workaround is documented in the available data.

CVE-2026-62107 is an unauthenticated PHP object injection vulnerability (CWE-502, deserialization of untrusted data) in the free Masteriyo LMS WordPress plugin, affecting all versions up to and including 3.4.0. An attacker can trigger it by sending a crafted request containing maliciously serialized PHP data to a plugin endpoint that unserializes untrusted input, without needing any login or privileges. Successful injection can let the attacker manipulate PHP objects, which may enable arbitrary code execution, data modification, or information disclosure depending on the gadget chains available on the site; the CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact. Any WordPress site running Masteriyo LMS 3.4.0 or earlier is affected. No public proof of concept, in-the-wild exploitation, or CISA KEV listing is known at this time.

Do: Upgrade Masteriyo LMS to a release newer than 3.4.0 as soon as the vendor's fix is published, and check the Patchstack advisory or plugin changelog for the exact fixed version number. Until patched, deactivate the plugin or restrict unauthenticated public access to it on internet-facing sites, since no login is required to trigger the flaw. No public PoC or in-the-wild exploitation is currently known, but monitor the advisory for updates and treat any exposed vulnerable site as potentially reachable by attackers once details emerge.

CVE-2026-62106 is an incorrect privilege-assignment flaw (CWE-266) in the WordPress plugin SMS Alert Order Notifications, affecting every version up to and including 3.9.9. A user holding only a subscriber-level account can send a crafted authenticated request to the plugin's inadequately protected routine and have their account's role or capabilities elevated, typically to administrator. That grants effectively full control of the affected site (reading or modifying data, changing settings, installing or editing plugins), consistent with the 8.8 high CVSS score with high confidentiality, integrity and availability impacts. Affected sites are WordPress installations, generally WooCommerce stores using the plugin for SMS order notifications, particularly where an attacker can obtain or self-register a subscriber account. As of this report there is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation in the wild is known; remediation is to update to a release newer than 3.9.9.

Do: Update SMS Alert Order Notifications to the latest available release (anything newer than 3.9.9). Until patched, reduce exposure by disabling or restricting open subscriber registration and review low-privileged accounts and any recent role changes for signs of tampering. Because exploitation requires a subscriber-level account, sites that do not allow self-registration face materially lower risk.