CVE-2016-11012

The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS...

PT-2025-22699 · Grafana +1 · Grafana Oss +1

Name of the Vulnerable Software and Affected Versions: Grafana OSS affected versions not specified Description: An access control issue was discovered where an Organization administrator could permanently delete the Server administrator account through the "DELETE /api/org/users/" endpoint. This...

CVE-2009-1085

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh...

CVE-2025-39352

Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through = 7.0...

CVE-2025-43838 WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability

Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through = 1.0.1...

CVE-2025-43838 WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability

Missing Authorization vulnerability in ChoPlugins Custom PC Builder Lite for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through 1.0.1...

CVE-2025-43838

CVE-2025-43838 affects ChoPlugins Custom PC Builder Lite for WooCommerce (WordPress plugin)

CVE-2025-48282

CVE-2025-48282 affects WordPress plugin Majestic Support (versions up to and including 1.1.0). The flaw is a Missing Authorization vulnerability caused by incorrectly configured access control levels, enabling bypass of protections without authentication. CVSS 3.1 base score 5.3 (Network, Low att...

CVE-2025-48268 WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through = 1.2.6...

CVE-2025-48247 WordPress Shortlinks by Pretty Links <= 3.6.15 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortlinks by Pretty Links: from n/a through 3.6.15...

CVE-2025-47560

Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.6.13...

CVE-2025-31923

Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through = 3.0...

CVE-2025-31066

Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through = 1.6.5...

CVE-2025-39482

Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through 3.11.4...

CVE-2024-6668

The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2025-39537

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through = 1.2.3...

CVE-2025-31065 WordPress Rozario <= 1.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4...

CVE-2025-31063 WordPress Wishlist <= 2.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in redqteam Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Wishlist: from n/a through 2.1.0...

CVE-2025-32296

CVE-2025-32296 affects WordPress plugin Simple Link Directory Pro

CVE-2025-39537 WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through = 1.2.3...