CVE-2024-10536

The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handleblockshortcodeexport function in all versions up to, and including, 6.0.0. This...

CVE-2024-10536 FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export

The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handleblockshortcodeexport function in all versions up to, and including, 6.0.0. This...

CVE-2024-9697

CVE-2024-9697 concerns the WordPress plugin Social Rocket – Social Sharing Plugin . The vulnerability is an unauthorized data modification flaw caused by a missing capability check in tweet_settings_save() and tweet_settings_update() across all versions up to and including 1.3.4. This permits aut...

CVE-2024-12176

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wlconfigplugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2024-10527

The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motechspacercallback function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view...

CVE-2024-11496 Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update

The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilityglobalajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-12176 WordLift – AI powered SEO – Schema <= 3.54.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wlconfigplugin' AJAX action in all versions up to, and including, 3.54.0. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2024-12176

CVE-2024-12176 (WordLift – AI powered SEO – Schema) details : The WordLift WordPress plugin is vulnerable to unauthorized access via a missing capability check on the wl_config_plugin AJAX action, affecting all versions up to and including 3.54.0. This enables unauthenticated attackers to update ...

CVE-2024-12252 SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to overwrite the seo-beginner-auto-post.php file which can...

CVE-2024-10527 Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure

The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motechspacercallback function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view...

CVE-2024-10527

The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motechspacercallback function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view...

CVE-2024-12559

The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesignsaddapi' and the 'clickdesignsremoveapi' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to...

CVE-2024-12022

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-52485. Reason: This candidate is a reservation duplicate of CVE-2024-52485. Notes: All CVE users should reference CVE-2024-52485 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2024-12559 ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal

The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesignsaddapi' and the 'clickdesignsremoveapi' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to...

PT-2025-1662 · WordPress · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global plugin for WordPress versions up to, and including, 2.9.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to update plugin options, potentially breaking the site, due to a missing...

PT-2025-1895 · WordPress · Clickdesigns

Name of the Vulnerable Software and Affected Versions: ClickDesigns plugin for WordPress versions up to, and including, 1.8.0 Description: The issue allows unauthorized modification of data due to a missing capability check on the clickdesigns add api and the clickdesigns remove api functions. Th...

PT-2025-1729 · WordPress · Wp Menu Image

Name of the Vulnerable Software and Affected Versions: WP Menu Image plugin for WordPress versions up to, and including, 2.2 Description: The issue is related to a missing capability check on the wmi delete img menu function, which allows unauthenticated attackers to delete images from menus. Thi...

PT-2025-1933 · WordPress · Rsvp/Event Management Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: RSVP and Event Management plugin for WordPress versions up to, and including, 2.7.13 Description: The issue allows unauthorized access due to a missing capability check on several AJAX functions, such as bulk delete attendees and bulk delete...

PT-2025-1950 · Aurum · Aurum

Name of the Vulnerable Software and Affected Versions: Aurum - WordPress & WooCommerce Shopping Theme versions prior to 4.0.3 Description: The issue concerns a missing capability check in the lab 1cl demo install package content function, allowing authenticated attackers with Subscriber-level...

PT-2025-1817 · WordPress · Lazyload Background Images

Name of the Vulnerable Software and Affected Versions: LazyLoad Background Images plugin for WordPress versions up to and including 1.0.7 Description: The issue arises from a missing capability check on the pblzbg save settings function, allowing authenticated attackers with Subscriber-level acce...