PT-2024-38215 · WordPress · Woocommerce Google Feed Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Google Feed Manager plugin for WordPress versions 1.0 through 2.8.0 Description: The issue is due to a missing capability check on the wppfm removeFeedFile function, allowing authenticated attackers with Contributor-level access a...

CVE-2024-7390

The WP Testimonial Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function in all versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to change the order of...

CVE-2024-7030

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-7030

Summary (CVE-2024-7030) : The WordPress plugin “Smart Online Order for Clover” is vulnerable in all versions up to and including 1.5.6 due to a missing capability check. This enables authenticated attackers with Subscriber-level access and above to modify data such as product/category description...

CVE-2024-7030 Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-7030 Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-5941

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers,...

PT-2024-38318 · WordPress · Testimonials Widget

Name of the Vulnerable Software and Affected Versions: WP Testimonial Widget plugin for WordPress versions up to, and including, 3.0 Description: The issue is related to unauthorized modification of data due to a missing capability check on the fnSaveTestimonailOrder function. This allows...

PT-2024-38036 · WordPress · Smart Online Order For Clover

Name of the Vulnerable Software and Affected Versions: The Smart Online Order for Clover plugin for WordPress versions up to, and including, 1.5.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to update product and category descriptions, category...

PT-2024-38038 · WordPress · Smart Online Order For Clover

Name of the Vulnerable Software and Affected Versions: The Smart Online Order for Clover plugin for WordPress versions up to, and including, 1.5.6 Description: The issue is related to a missing capability check on the moo deactivateAndClean function, which allows unauthenticated attackers to...

PT-2024-37925 · WordPress · Event Espresso 4 Decaf

Name of the Vulnerable Software and Affected Versions: Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress versions up to, and including, 5.0.22.decaf Description: The issue is related to a missing capability check on the saveTimezoneString and some other functions,...

CVE-2023-4024

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances...

CVE-2023-4027

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatesettings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings...

CVE-2023-4025

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances...

CVE-2023-4730 LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpoint

The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the initendpoint function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An...

PT-2024-12869 · WordPress · Radio Player

Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue is related to a missing capability check on the update player function, allowing unauthenticated attackers to update player instances. This enables...

PT-2024-13437 · WordPress · Ladiapp

Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to and including 4.3 Description: The issue allows unauthorized modification of data due to a missing capability check on the init endpoint function. This enables unauthenticated attackers to modify...

PT-2024-12877 · WordPress · Radio Player

Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue allows unauthorized modification of data due to a missing capability check on the update settings function. This makes it possible for...

CVE-2024-6987

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-6987

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...