WordPress Bit Assist plugin <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter vulnerability

Path Traversal to Authenticated Subscriber+ Arbitrary File Read via fileID Parameter vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Bit Assist versions = 1.5.2...

WordPress Read More & Accordion plugin <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary 'Read More' Post Deletion vulnerability discovered by theviper17y in WordPress Plugin Read More & Accordion versions = 3.4.2...

WordPress Puzzles theme <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Theme Puzzles versions = 4.2.4...

WordPress Click Mag theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Deletion vulnerability discovered by Lucio Sá in WordPress Theme Click Mag versions = 3.6.0...

WordPress aDirectory plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Peter Thaleikis in WordPress Plugin aDirectory versions = 2.3...

WordPress Zox News plugin <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Modification vulnerability discovered by Lucio Sá in WordPress Theme Zox News versions = 3.17.0...

CVE-2024-13333

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fmalocalfilesystem' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload...

WordPress JS Help Desk plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Tim Coen in WordPress Plugin JS Help Desk versions = 2.8.8...

WordPress Eventer plugin <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

Missing Authorization to Authenticated Subscriber+ Bookings Export vulnerability discovered by István Márton in WordPress Plugin Eventer versions = 3.9.9...

WordPress Food Menu plugin <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by abrahack in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions = 5.1.4...

WordPress Ni Sales Commission For WooCommerce plugin <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update vulnerability

Missing Authorization to Authenticated Subscriber+ Commission Update vulnerability discovered by SOPROBRO in WordPress Plugin Ni Sales Commission For WooCommerce versions = 1.2.4...

WordPress Single-user-chat plugin <= 0.5 - Authenticated (Subscriber+) Limited Options Update vulnerability

Authenticated Subscriber+ Limited Options Update vulnerability discovered by Colin Xu in WordPress Plugin Single-user-chat versions = 0.5...

WordPress Royal Core plugin <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Plugin Royal Core versions = 2.9.2...

WordPress Zox News plugin <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Theme Zox News versions = 3.16.0...

WordPress Youzify plugin <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by Stiofan in WordPress Plugin Youzify versions = 1.3.4...

WordPress WP Hotel Booking plugin <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval vulnerability

Missing Authorization to Authenticated Subscriber+ User Email Retrieval vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Hotel Booking versions = 2.1.6...

WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...

WordPress Buzz Club Theme plugin <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Option Update vulnerability discovered by Lucio Sá in WordPress Theme Buzz Club versions = 2.0.4...

WordPress Sandbox plugin <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download vulnerability

Missing Authorization to Authenticated Subscriber+ Sandbox Download vulnerability discovered by Stiofan in WordPress Theme Sandbox versions = 0.4...

WordPress Passwords Manager plugin <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key vulnerability

Missing Authorization to Authenticated Subscriber+ Add Password + Update Encryption Key vulnerability discovered by Lucio Sá in WordPress Plugin Passwords Manager versions = 1.4.8...