CVE-2023-5533: Missing Authorization

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions tha...

WP Meta and Date Remover < 2.2.0 - Subscriber+ Stored XSS

Description The plugin provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site...

CVE-2023-5369

Before correction, the copyfilerange system call checked only for the CAPREAD and CAPWRITE capabilities on the input and output file descriptors, respectively. Using an offset is logically equivalent to seeking, and the system call must additionally require the CAPSEEK capability. This incorrect...

kernel security, bug fix, and enhancement update

4.18.0-477.27.0.18.OL8 - bluetooth: Perform careful capability checks in hcisockioctl CVE-2023-2002 - ipvlan:Fix out-of-bounds caused by unclear skb-cb CVE-2023-3090 - net/sched: clsfw: Fix improper refcount update leads to use-after-free CVE-2023-3776 - netfilter: nftsetpipapo: fix improper...

WP Fastest Cache Plugin for WordPress < 1.1.3 Multiple Vulnerabilities

The WordPress Fastest Cache Plugin installed on the remote host suffers from multiple vulnerabilities: - A nonce validation issue on the wpfcpreloadsinglecallback function leading to a Cross-Site Request Forgery CSRF vulnerability permitting attackers to invoke a cache building action CVE-2023-19...

CVE-2023-3999

The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and...

CVE-2023-3999

CVE-2023-3999 affects The Waiting: One-click countdowns plugin for WordPress. The issue is an authorization bypass caused by missing capability checks on AJAX calls in versions up to and including 0.6.2. This allows authenticated attackers with subscriber-level permissions and above to create and...

CVE-2023-3999 Waiting: One-click countdowns <= 0.6.2 - Missing Authorization

The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and...

CVE-2023-2078

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-2078

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-2078

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-2078 Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Missing Authorization

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-2078: Missing Authorization

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2020-8934

The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the adminenqueuescripts action which displays the connection key. This makes it possible for authenticated attacker...

CVE-2021-4388

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestatesetfeatureproperty and opalestateremovefeatureproperty functions. This makes it possible for unauthenticated...

Design/Logic Flaw

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestatesetfeatureproperty and opalestateremovefeatureproperty functions. This makes it possible for unauthenticated...

CVE-2021-4388

The CVE-2021-4388 entry concerns the Opal Estate plugin for WordPress, vulnerable up to version 1.6.11 due to missing capability checks in opalestate_set_feature_property() and opalestate_remove_feature_property(). This flaw allows unauthenticated attackers to set or remove featured properties. T...

PT-2023-12500 · WordPress · Opal Estate

Name of the Vulnerable Software and Affected Versions: Opal Estate plugin for WordPress versions up to, and including, 1.6.11 Description: The issue is related to missing capability checks on the opalestate set feature property and opalestate remove feature property functions. This allows...

CVE-2021-4388: Missing Authorization

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestatesetfeatureproperty and opalestateremovefeatureproperty functions. This makes it possible for unauthenticated...

Gallery Metabox <= 1.5 - Subscriber+ Unauthorized Data Access

The plugin does not correctly implement capability checks on the refreshmetabox function, leading to unauthorized access of data. As a result, subscribers can obtain a list of images attached to a post...