PT-2025-16509 · Unknown · Macro Calculator With Admin Email Optin & Data

Name of the Vulnerable Software and Affected Versions: NotFound Macro Calculator with Admin Email Optin & Data versions n/d through 1.0 Description: The issue concerns exposure of sensitive system information to an unauthorized control sphere. This problem affects the Macro Calculator with Admin...

PT-2024-14910 · WordPress · Eventon Pro

Name of the Vulnerable Software and Affected Versions: The EventON PRO - WordPress Virtual Event Calendar Plugin plugin versions up to, and including, 4.6.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the admin test email functio...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

WordPress plugin WCFM 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-8428

The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submitformhandler due to missing validation on the 'userid' user controlled key. This makes it possible...

WordPress WPLMS Theme Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress WPLMS Theme Privilege Escalation', 'Description' = %q The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an authenticated...

PT-2024-37916 · WordPress · Falang Multilanguage For Wordpress

Name of the Vulnerable Software and Affected Versions: Falang multilanguage for WordPress plugin versions up to, and including, 1.3.52 Description: The issue allows authenticated attackers with Subscriber-level access and above to update and delete translations and expose the administrator email...

CVE-2024-3927

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an...

CVE-2024-3927 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an...

CVE-2024-3927 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an...

CVE-2024-3927

CVE-2024-3927 affects the WordPress plugin “Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)”. The vulnerability is a form submission admin email bypass where unauthenticated attackers can bypass admin-email restrictions by submitting a conta...

WordPress Element Pack Elementor Addons plugin <= 5.6.3 - Form Submission Admin Email Bypass vulnerability

Form Submission Admin Email Bypass vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Element Pack Elementor Addons versions = 5.6.3...

Element Pack Elementor Addons < 5.6.4 - Form Submission Admin Email Bypass

Description The plugin is vulnerable to Form Submission Admin Email Bypass due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form...

CVE-2024-1315

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtclupdateuseraccount' function. This makes it possible fo...

Campcodes Complete Online Beauty Parlor Management System 安全漏洞

Campcodes Complete Online Beauty Parlor Management System is an online beauty parlor management system from Campcodes, Inc. A security vulnerability exists in Campcodes Complete Online Beauty Parlor Management System version 1.0, which originates from an SQL injection vulnerability in the email...

WordPress Plugin Seriously Simple Podcasting Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-14956 · WordPress · Seriously Simple Podcasting

Name of the Vulnerable Software and Affected Versions: Seriously Simple Podcasting WordPress plugin versions prior to 3.0.0 Description: The issue discloses the Podcast owner's email address, which by default is the admin email address, via an unauthenticated crafted request. Recommendations: For...

CVE-2023-7202 Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending

The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its testerror AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF...

CVE-2023-7202

CVE-2023-7202 affects the Fatal Error Notify WordPress plugin prior to 1.5.3. The root cause is missing authorization checks and CSRF protections in the test_error AJAX action, enabling any authenticated user (e.g., a Subscriber) to trigger error emails to the site admin. This also enables CSRF e...

PT-2024-15227 · WordPress · Fatal Error Notify

Name of the Vulnerable Software and Affected Versions: Fatal Error Notify WordPress plugin versions prior to 1.5.3 Description: The issue affects the test error AJAX action in the Fatal Error Notify WordPress plugin, which lacks authorisation and CSRF checks. This allows any authenticated users,...