154 matches found
WordPress Ivory Search plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation vulnerability
Missing Authorization to Authenticated Subscriber+ Index Creation vulnerability discovered by Thura Moe Myint mgthuramoemyint in WordPress Plugin Ivory Search versions = 5.5.5...
CVE-2024-1568
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApiHtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to...
PT-2023-32083 · WordPress · Funnelforms Free
Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.4 Description: The issue allows authenticated attackers with subscriber-level permissions and above to create copies of arbitrary posts due to a missing capability check o...
CVE-2023-24009
Auth. subscriber+ Reflected Cross-site Scripting XSS vulnerability in Wpazure Themes Upfrontwp theme = 1.1 versions...
CVE-2023-2249
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of filegetcontents without appropriate verification of the data being supplied to the function...
CVE-2023-1895
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the getremotecontent REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary...
CVE-2022-45812
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in Martin Lees Exxp plugin = 2.6.8 versions...
CVE-2023-27619
Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...
CVE-2022-4935
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...
CVE-2022-45369
Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...
CVE-2022-41788
Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...
CVE-2022-36341
Authenticated subscriber+ plugin settings change leading to Stored Cross-Site Scripting XSS vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin = 1.0 at WordPress...