CVE-2023-6742 Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'enviragalleryinsertimages' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated...

CVE-2023-6855 Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck function in...

CVE-2023-6883

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Design/Logic Flaw

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2023-6883

CVE-2023-6883 : The Easy Social Feed plugin for WordPress (versions up to 6.5.2) is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This allows authenticated attackers with subscriber-level access and above to perform actions such as m...

CVE-2023-6742: Missing Authorization

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'enviragalleryinsertimages' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated...

PT-2024-15181 · WordPress · The Lightstart – Maintenance Mode

Name of the Vulnerable Software and Affected Versions: The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress versions up to, and including, 2.6.8 Description: The issue is related to a missing capability check on the insert template function, allowing...

CVE-2023-6369: Missing Authorization

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with...

CVE-2023-6751: Missing Authorization

The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publishwebsite in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode...

PT-2024-15118

Name of the Vulnerable Software and Affected Versions Easy Social Feed plugin for WordPress versions up to, and including, 6.5.2 Description The issue allows authenticated attackers with subscriber-level access and above to perform unauthorized actions due to a missing capability check on multipl...

CVE-2023-6883: Missing Authorization

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

PT-2024-15020

Name of the Vulnerable Software and Affected Versions SpeedyCache plugin for WordPress versions up to, and including, 1.1.3 Description The issue allows unauthorized modification of data due to a missing capability check on the speedycache save varniship, speedycache img update settings,...

CVE-2023-6638: Missing Authorization

The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatesettings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings...

CVE-2023-6637: Missing Authorization

The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatesettings' function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin...

PT-2024-15038 · WordPress · Caos | Host Google Analytics Locally

Name of the Vulnerable Software and Affected Versions: CAOS | Host Google Analytics Locally plugin for WordPress versions up to, and including, 4.7.14 Description: The issue allows unauthorized modification of data due to a missing capability check on the update settings function. This makes it...

PT-2024-15039 · WordPress · Gtg Product Feed For Shopping

Name of the Vulnerable Software and Affected Versions: GTG Product Feed for Shopping plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to a missing capability check on the update settings function, allowing unauthenticated attackers to update plugin...

Envira Gallery Lite < 1.8.7.3 - Missing Authorization to Gallery Modification via envira_gallery_insert_images

Description The plugin is vulnerable to unauthorized modification of data due to an improper capability check on the 'enviragalleryinsertimages' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify...

CVE-2023-6598: Missing Authorization

The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycachesavevarniship, speedycacheimgupdatesettings, speedycachepreloadingaddsettings, and speedycachepreloadingdeleteresource functions in all versions up to, and...

CVE-2023-6158

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...

Design/Logic Flaw

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...