The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) + bbp_reply_content (via bbPress reply form)' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker to wrap their crafted reply in a <pre> block, which prevents WordPress's wpautop/wptexturize processors from converting straight double quotes in the stored display name into typographic curly-quote entities that would otherwise neutralize the attribute-injection.
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
The Super Forms – Drag & Drop Form Builder WordPress plugin is vulnerable to arbitrary file and directory deletion in all versions up to and including 6.3.316. This vulnerability allows authenticated users with Subscriber-level access or higher to delete files and directories on the server, including critical WordPress files such as wp-config.php. The flaw arises from insufficient capability checks and improper sanitization of user-controlled input in AJAX handlers, enabling recursive deletion that can lead to full site takedown and potential remote code execution if the site is reinstalled by an attacker.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (any URL parameter consumed by the form's calculated equation)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link.
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
A critical authentication bypass vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager allows remote, unauthenticated attackers to gain administrative access by exploiting improper URI encoding handling in HTTP requests. The vulnerability affects all Catalyst SD-WAN Manager deployments and has been actively exploited in the wild. Cisco has released patches for multiple versions and provided indicators of compromise to assist detection. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.
A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters.
If the device receives a specially crafted, malicious request, it may trigger unintended processing.
ByteCoreStack – MCP Connector for AI Tools plugin for WordPress versions up to 1.2.3 contains a privilege escalation vulnerability. Authenticated users with Subscriber-level access or higher can exploit improper privilege management in the wp_update_user_meta MCP tool to elevate their privileges to Administrator by modifying unprotected meta keys such as wp_capabilities. This vulnerability arises from insufficient gating of meta key writes and an incomplete meta key blocklist.
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role against the administrator-configured register_user_role, without an allow-list, and without any current_user_can() capability check. This makes it possible for unauthenticated attackers to register a new account with the Administrator role by injecting role=administrator into the data submitted to any published Super Forms registration form (register_login_action='register').
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.18 is vulnerable to reflected cross-site scripting (XSS) via the Referer header. This occurs when an ad block uses the '{search-query}' dynamic tag, which processes the HTTP Referer header insufficiently, allowing injection of arbitrary JavaScript. Exploitation requires an ad block configured with this tag and automatic insertion enabled. The vulnerability can lead to script execution in the context of any site visitor, including administrators.
LearnPress – WordPress LMS Plugin versions up to 4.4.8 contains an authorization bypass vulnerability due to insecure direct object references. This flaw allows unauthenticated attackers to access and download course material files from paid or enrollment-required courses if any course on the site has 'No Required Enroll' enabled. The vulnerability arises because the AJAX endpoint lp-ajax-handle (load_content_via_ajax) does not perform capability checks and authorizes access based on one attacker-controlled identifier while fetching data using another unchecked identifier.
The Social Media Share Buttons & Social Sharing Icons WordPress plugin up to version 3.0.1 is vulnerable to reflected cross-site scripting (XSS) via URL parameters. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user accesses a crafted page and clicks the WeChat share icon on a mobile device. The vulnerability arises from insufficient input sanitization and output escaping.
MetaMask, a cryptocurrency wallet provider, has disclosed an ongoing security incident affecting some of its infrastructure. Details about the nature of the incident, affected components, or impact have not been provided. There is no information on exploited vulnerabilities or affected software versions. No patch or remediation status is available at this time.
CVE-2025-41753 is a critical path traversal vulnerability in the WAGO 0751-9x01 device. The vulnerability arises because the object name of a dynamically created BACnet File Object is used as a file path without proper validation. This allows an unauthenticated remote attacker to traverse directories outside the intended restricted directory and read or overwrite arbitrary files on the device. Exploitation could lead to full system compromise.
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.