CVE-2024-9686

The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfwsendtestmessage' function in versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to send a test messa...

PT-2024-39730 · WordPress · Wps Telegram Chat

Name of the Vulnerable Software and Affected Versions: WPS Telegram Chat plugin for WordPress versions up to, and including, 4.5.4 Description: The issue is related to authorization bypass due to a missing capability check when accessing messages. This allows unauthenticated attackers to view...

CVE-2024-8667 HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign function in all versions up to, and including, 2.10.0. This makes it possible for...

CVE-2024-8667

CVE-2024-8667: HurryTimer plugin for WordPress and WooCommerce vulnerable to unauthorized post publication due to missing capability check in activateCampaign() in versions up to 2.10.0. Authenticated attackers with contributor-level access or higher can publish arbitrary posts. Remediation: upgr...

CVE-2024-9531 MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvxsentdeactivationrequest' function in all versions up to, and including, 4.2.4. This makes it possible f...

PT-2024-39681 · WordPress · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to, and including, 4.2.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to send a canned...

PT-2024-39165 · WordPress · The Hurrytimer

Name of the Vulnerable Software and Affected Versions: The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin versions up to, and including, 2.10.0 Description: The issue allows authenticated attackers with contributor-level access and above to publish arbitra...

CVE-2024-9829

The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwaphandledownloaduser' and 'dpwaphandledownloadcomment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, wit...

PT-2024-39700 · WordPress · The Rss Aggregator – Rss Import

Name of the Vulnerable Software and Affected Versions: The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress versions up to, and including, 4.23.12 Description: The issue is related to a missing capability check on the wprss ajax send premium support...

PT-2024-39871 · Unknown · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to download any comment and metadata for any user, including sensitive information such as...

CVE-2024-10003

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2024-15968 · WordPress · Rover Idx Plugin

Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to, and including, 3.0.0.2903 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This makes it possible for...

CVE-2024-9364

The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wpmailplusclearlogs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

PT-2024-16011 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to a missing capability check on multiple functions, which allows authenticated attackers with subscriber-level access and above to...

PT-2024-39595 · WordPress · Bulk Images Optimizer

Name of the Vulnerable Software and Affected Versions: The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to a missing capability check on the save configuration function, allowing...

PT-2024-39596 · WordPress · Sendgrid For Wordpress

Name of the Vulnerable Software and Affected Versions: SendGrid for WordPress plugin versions up to, and including, 1.4 Description: The issue is related to a missing capability check on the wp mailplus clear logs function, which allows authenticated attackers with Subscriber-level access and abo...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36840

The vulnerability CVE-2020-36840 affects the WordPress plugin Timetable and Event Schedule by MotoPress (versions up to 2.3.8). It is an authorization bypass caused by a missing capability check on the wp_ajax_route_url() function invoked via a nopriv AJAX action. This allows unauthenticated atta...

CVE-2023-7294

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the createmollieprofile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-leve...

CVE-2023-7294

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the createmollieprofile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-leve...