PT-2024-15275 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized data modification due to a missing capability check on the create mollie profile functio...

CVE-2024-9756 Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoaaddattachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-9187 Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion

The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm function in all versions up to, and including, 1.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete read...

CVE-2024-9187 Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion

The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm function in all versions up to, and including, 1.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete read...

PT-2024-39820 · WordPress · Order Attachments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Order Attachments for WooCommerce plugin for WordPress versions 2.0 through 2.4.1 Description: The issue is related to unauthorized limited arbitrary file uploads due to a missing capability check on the "wcoa add attachment" AJAX action. Thi...

PT-2024-39868 · WordPress · The Imagepress – Image Gallery

Name of the Vulnerable Software and Affected Versions: The ImagePress – Image Gallery plugin for WordPress versions prior to 1.2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization. This is due to a missing capability...

CVE-2024-9587

The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxlinkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-level privileges or above, to update plug...

CVE-2024-9685

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftbtestaction' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2024-39704 · WordPress · Linkz.Ai

Name of the Vulnerable Software and Affected Versions: Linkz.ai plugin for WordPress versions up to, and including, 1.1.8 Description: The issue allows unauthorized modification of data due to a missing capability check on the ajax linkz function. This makes it possible for authenticated attacker...

Exploit for CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Missing Authorization via...

PT-2024-39402 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete...

CVE-2024-8431

CVE-2024-8431 affects the WordPress plugin Robo Gallery (Photo Gallery, Images, Slider) up to version 3.2.21. The flaw is a missing capability check in ajaxGetGalleryJson(), allowing authenticated users with Subscriber+ privileges to retrieve private post titles. Public exploitation details are n...

PT-2024-39008 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery plugin for WordPress versions up to, and including, 3.2.21 Description: The issue is related to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson function. This allows authenticated...

CVE-2024-8430

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

CVE-2024-8430 Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

PT-2024-39146 · WordPress · The Kb Support – Wordpress Help Desk/Knowledge Base

Name of the Vulnerable Software and Affected Versions: The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthorized access and modification of data due to a missing capability check on the kbs ajax loa...

PT-2024-39007 · WordPress · Spice Starter Sites

Name of the Vulnerable Software and Affected Versions: Spice Starter Sites plugin for WordPress versions 1.2.5 and earlier Description: The issue allows unauthorized modification of data due to a missing capability check on the spice starter sites importer creater function. This makes it possible...

PT-2024-39169 · WordPress · Soumettre.Fr

Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on the...

CVE-2024-9189

The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the algwceuvatexemptvatfromadmin function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to updat...

PT-2024-39478 · WordPress · Eu/Uk Vat Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: EU/UK VAT Manager for WooCommerce plugin for WordPress versions up to, and including, 2.12.12 Description: The issue allows unauthorized modification of data due to a missing capability check on the alg wc eu vat exempt vat from admin functio...