PT-2025-6441 · WordPress · The Puzzles | Wp Magazine / Review With Store Wordpress Theme + Rtl

Name of the Vulnerable Software and Affected Versions: The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress versions up to, and including, 4.2.4 Description: The issue is related to a missing capability check on the theme options ajax post action AJAX action,...

PT-2025-6429 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.13 Description: The issue is related to a missing capability check on the reorder route function, allowing unauthenticated attackers to modif...

PT-2025-6436 · Zoxpress +1 · Zoxpress +1

Name of the Vulnerable Software and Affected Versions: The ZoxPress - The All-In-One WordPress News Theme versions up to, and including, 2.12.0 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the backup options...

PT-2025-6434 · WordPress · Wpsyncsheets Lite For Wpforms

Name of the Vulnerable Software and Affected Versions: WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to unauthorized modification of data due to a missing capability check on the wpsslwp...

PT-2025-6443 · WordPress · Wp Table Manager

Name of the Vulnerable Software and Affected Versions: WP Table Manager plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to a missing capability check on the thewptm getFolders AJAX action, allowing authenticated attackers with Subscriber-level access an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hiding the first-in-list PCIe extended capabilities There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability i.e., a capability with an ID greater than...

PT-2025-6170 · WordPress · Zox News - Professional Wordpress News & Magazine Theme

Name of the Vulnerable Software and Affected Versions: Zox News - Professional WordPress News & Magazine Theme plugin for WordPress versions up to and including 3.17.0 Description: The vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks...

UK Is Ordering Apple to Break Its Own Encryption

The Washington Post is reporting that the UK government has served Apple with a "technical capability notice" as defined by the 2016 Investigatory Powers Act, requiring it to break the Advanced Data Protection encryption in iCloud for the benefit of law enforcement. This is a big deal, and...

CVE-2024-11133

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handlepdfdownloadrequest' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets...

CVE-2024-11134

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventerexportbookingscsv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to...

Astra Linux - уязвимость в runc

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where runc exec --cap created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: tty: Require CAPSYSADMIN for all usages of TIOCLSELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f "tty: Permit some TIOCLSETSEL modes without CAPSYSADMIN", but as it turns out, 1 the logic I...

CVE-2021-4361

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchjobintegrationssettinsave AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on...

CVE-2021-4355

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the downloadorderdetaillist, changeorderlist, and downloadmemberlist functions called via admininit hooks in versions up to, and including, 2.2.7. This makes it possible for...

CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

CVE-2020-36696

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handledownloads function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable...

CVE-2024-7258

The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfmremoveFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2024-12202

The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusicajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated attackers, with...

CVE-2024-12172

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

CVE-2024-12365

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the isw3tcadminpage function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain...