Design/Logic Flaw

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bookingexportall function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with...

CVE-2024-1126 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getattendeesemailbyeventid function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, wi...

CVE-2024-0369

CVE-2024-0369 affects the WordPress plugin Bulk Edit Post Titles, with all versions up to and including 5.0.0 vulnerable due to a missing capability check in bulkUpdatePostTitles. This flaw allows authenticated users with subscriber access or higher to modify titles of arbitrary posts. The issue ...

CVE-2024-2172 Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation

The Malware Scanner plugin and the Web Application Firewall plugin for WordPress both by MiniOrange are vulnerable to privilege escalation due to a missing capability check on the mowpnsinit function in all versions up to, and including, 4.7.2 for Malware Scanner and 2.1.1 for Web Application...

CVE-2024-1176

CVE-2024-1176 affects the HT Easy GA4 – Google Analytics WordPress Plugin. The vulnerability is a missing capability check in login() that enables unauthenticated modification of the GA4 email. Affected versions are all up to and including 1.1.5. Remediation: upgrade to 1.1.6 or later (Wordfence/...

PT-2024-16874 · WordPress · Eventprime – Events Calendar

Name of the Vulnerable Software and Affected Versions: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 3.4.1 Description: The issue allows unauthorized access to data due to a missing capability check on the booking export all function...

PT-2024-15567 · WordPress · Artibot Free Chat Bot

Name of the Vulnerable Software and Affected Versions: ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress versions up to, and including, 1.1.6 Description: The issue allows authenticated attackers with subscriber-level access and above to update plugin settings due to a missing...

PT-2024-17992 · WordPress · Relevanssi

Name of the Vulnerable Software and Affected Versions: Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.22.0 Description: The issue is related to a missing capability check on the relevanssi export log check function, allowing unauthenticated attackers to export...

PT-2024-18354 · WordPress · Auto Affiliate Links

Name of the Vulnerable Software and Affected Versions: Auto Affiliate Links plugin for WordPress versions up to, and including, 6.4.3 Description: The issue allows authenticated attackers with subscriber access or higher to modify data without proper authorization. This is due to a missing...

PT-2024-15519 · WordPress · Categorify

Name of the Vulnerable Software and Affected Versions: Categorify plugin for WordPress versions up to, and including, 1.0.7.4 Description: The issue allows authenticated attackers with subscriber-level access and above to modify data without proper authorization. This is due to a missing capabili...

CVE-2023-4728

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publishlp function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and abov...

CVE-2023-4728

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publishlp function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and abov...

CVE-2023-4626

The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflowsavehook function in versions up to, and including, 4.3. This makes it possible for authenticated attackers with subscriber-level access and above to update the...

PT-2024-13343 · WordPress · Ladiapp

Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to, and including, 4.3 Description: The issue is related to a missing capability check on the ladiflow save hook function, allowing authenticated attackers with subscriber-level access and above to...

PT-2024-13434 · WordPress · Ladiapp

Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to, and including, 4.4 Description: The issue arises from a missing capability check on the publish lp function, which is hooked via an AJAX action. This allows authenticated attackers with...

CVE-2024-1645

The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export...

PT-2024-18011 · WordPress · Mollie Forms

Name of the Vulnerable Software and Affected Versions: Mollie Forms plugin for WordPress versions up to, and including, 2.6.3 Description: The issue is related to a missing capability check on the duplicateForm function, allowing authenticated attackers with subscriber access or higher to duplica...

CVE-2024-1870

The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access ...

CVE-2024-1125

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendareventsdelete function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with...

PT-2024-16849 · WordPress · Eventprime – Events Calendar

Name of the Vulnerable Software and Affected Versions: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 3.4.1 Description: The issue is related to unauthorized email sending due to a missing capability check on the ep send attendees email...