CVE-2024-12627 Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the captureemail AJAX action. This...

Exploit for CVE-2024-49699

CVE-2024-49699 ARPrice...

CVE-2024-12618

The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-12616

The Bitlys WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-12616

The CVE-2024-12616 entry applies to Bitly's WordPress Plugin (up to version 2.7.3). The vulnerability is due to a missing capability check on several AJAX actions, allowing authenticated attackers with Subscriber-level access and above to modify and read plugin settings. This is documented in the...

CVE-2024-12618

The CVE CVE-2024-12618 affects Newsletter2Go for WordPress. A missing capability check on the resetStyles AJAX action in all versions up to 4.0.14 allows authenticated attackers with Subscriber-level access and above to modify data by resetting styles. Connected sources confirm the issue details ...

CVE-2024-12855

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12855

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12855 AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12855 AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12855

CVE-2024-12855: AdForest WordPress theme (AdForest) is vulnerable due to a missing capability check on multiple AJAX actions (e.g., sb_remove_ad) across versions up to 5.1.7, allowing authenticated users with Subscriber-level access and above to delete posts/attachments and deactivate a license. ...

CVE-2024-12112

The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'addformEmsfb' AJAX action in all versions up to, and including, 3.8.8 due to...

CVE-2024-12711

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulkdeleteattendees and bulkdeletequestions in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers t...

CVE-2024-12711 RSVP and Event Management <= 2.7.13 - Missing Authorization

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulkdeleteattendees and bulkdeletequestions in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers t...

CVE-2024-12711 RSVP and Event Management <= 2.7.13 - Missing Authorization

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulkdeleteattendees and bulkdeletequestions in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers t...

WordPress Croma Music plugin <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax vulnerability

Authenticated Subscriber+ Arbitrary Options Update in ironMusicajax vulnerability discovered by Tonn in WordPress Plugin Croma Music versions = 3.6...

PT-2025-1933 · WordPress · Rsvp/Event Management Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: RSVP and Event Management plugin for WordPress versions up to, and including, 2.7.13 Description: The issue allows unauthorized access due to a missing capability check on several AJAX functions, such as bulk delete attendees and bulk delete...

PT-2026-20840

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.6 SPIP versions prior to 4.2.17 SPIP versions prior to 4.1.20 Description The application does not properly verify authorization when displaying content of articles and sections rubriques in AJAX-loaded fragments,...

PT-2026-20842

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.3.9 SPIP versions 4.3.9 through 4.4.5 Description The software contains a flaw that allows an attacker to redirect a user to a malicious external site after they log in, specifically when the site is configured to use...

CVE-2024-12594

The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , Login customizer, Hide wp-login – Limit Login Attempts – Locked Site plugin for WordPress is vulnerable to privilege escalation due to a...