CVE-2024-3893

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtclfbgalleryimagedelete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticate...

CVE-2024-3893

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtclfbgalleryimagedelete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticate...

CVE-2024-3893 Classified Listing – Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtclfbgalleryimagedelete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticate...

CVE-2024-3893

CVE-2024-3893 affects the Classified Listing – Classified ads & Business Directory Plugin for WordPress. A missing capability check in the rtcl_fb_gallery_image_delete AJAX action allows authenticated users with subscriber-level access and above to delete arbitrary attachments on all versions up ...

Support Genix < 1.2.4 - Missing Authorization

Description The Support Genix plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in all versions up to, and including, 1.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform...

PT-2024-28284 · WordPress · The Classified Listing – Classified Ads & Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress versions up to, and including, 3.0.10.3 Description: The issue is related to a missing capability check on the rtcl fb gallery image delete AJAX action...

LoginPress Pro < 3.0.0 - Unauthenticated License Activation/Deactivation

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check, allowing unauthenticated attacks to activate and deactivate licenses...

Kernel: bluetooth: Unauthorized management command execution

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

Kernel: bluetooth: Unauthorized management command execution

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

CVE-2024-0900

The CVE-2024-0900 entry concerns the Elespare WordPress plugin. It documents a vulnerability that allows authenticated attackers with subscriber-level access and above to create arbitrary posts due to a missing capability check in the elespare_create_post() function, which is invoked via AJAX. Th...

CVE-2024-0900 Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation

The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elesparecreatepost function hooked via AJAX in all...

CVE-2024-3664

The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setthumbnail and deletethumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with...

CVE-2024-3664

CVE-2024-3664 affects the Quick Featured Images plugin for WordPress. The vulnerability is due to a missing capability check in set_thumbnail and delete_thumbnail, affecting all versions up to 13.7.0. It allows authenticated attackers with contributor level access or higher to delete thumbnails a...

CVE-2024-3664 Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting

The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setthumbnail and deletethumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with...

WPC Frequently Bought Together for WooCommerce < 7.0.4 - Missing Authorization

Description The WPC Frequently Bought Together for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajaxgetsearchresults, ajaximportexport, and ajaximportexportsave functions in versions up to, and including, 7.0.3. This makes it...

TrackShip for WooCommerce < 1.7.6 - Missing Authorization

Description The TrackShip for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.7.5. This makes it possible for unauthenticated attackers to perform an unauthorized action...

PeproDev Ultimate Invoice < 2.0.2 - Missing Authorisation

Description The plugin is vulnerable to unauthorized access due to a missing capability check on a function, allowing unauthenticated attacker to perform an unauthorized action...

PT-2024-15904 · WordPress · Elespare

Name of the Vulnerable Software and Affected Versions: Elespare plugin for WordPress versions up to, and including, 2.1.2 Description: The issue is related to unauthorized post creation due to a missing capability check on the elespare create post function, which is hooked via AJAX. This allows...

Open Close WooCommerce Store < 4.9.2 - Missing Authorization

Description The Open Close WooCommerce Store – Best Business Schedules Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxswitchactive and ajaxupdatetimezone functions in all versions up to, and including, 4.9.1. This makes...

Popup Anything < 2.8.1 - Missing Authorization

Description The Popup Anything – Popup for opt-ins and Lead Generation Conversions plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the popupaocrenderpopuppreview function in all versions up to, and including, 2.8.0. This makes it possible for...