PT-2023-23260 · Elementor · Elementor Pro

Name of the Vulnerable Software and Affected Versions: Elementor Pro versions up to, and including, 3.11.6 Description: The issue allows authenticated attackers with subscriber-level capabilities to update arbitrary site options, potentially leading to privilege escalation, due to a missing...

PT-2023-11368 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is due to missing capability checks on the admin init function, in addition to insufficient input validation. This allows unauthenticated attackers ...

PT-2023-11857 · WordPress · Login/Signup Popup

Name of the Vulnerable Software and Affected Versions: Login/Signup Popup plugin for WordPress versions up to, and including, 1.4 Description: The issue is related to authorization bypass due to missing capability checks on several functions. This allows authenticated attackers to inject arbitrar...

PT-2023-12491

Name of the Vulnerable Software and Affected Versions Pinterest Automatic plugin for WordPress versions up to, and including, 1.14.3 Description The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the wp pinterest automatic parse...

PT-2023-11841 · WordPress · Quick Page/Post Redirect Plugin

Name of the Vulnerable Software and Affected Versions: The Quick Page/Post Redirect Plugin for WordPress versions up to, and including, 5.1.9 Description: The issue is related to authorization bypass due to missing capability checks on the qppr save quick redirect ajax and qppr delete quick...

PT-2023-12495 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue is related to page content injection due to missing capability checks in the plugin's page-editing functionality. This allows...

PT-2023-12461 · WordPress · Jobsearch Wp Job Board

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to authorization bypass due to a missing capability check on the save locsettings function. This allows unauthenticated attacke...

PT-2023-12442 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file. This affects the...

PT-2023-11861

Name of the Vulnerable Software and Affected Versions The ListingPro - WordPress Directory & Listing Theme for WordPress versions prior to 2.6.1 Description The issue is related to a missing capability check on the lp cc addons actions function, allowing unauthenticated attackers to install,...

PT-2023-23266 · WordPress · B2Bking

Name of the Vulnerable Software and Affected Versions: B2BKing plugin for WordPress versions up to, and including, 4.6.00 Description: The issue allows authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site due to a missing capabilit...

PT-2023-12440 · Woocommerce +1 · Improved Product Options For Woocommerce +15

Name of the Vulnerable Software and Affected Versions: Product Filter for WooCommerce versions prior to 8.2.0 Improved Product Options for WooCommerce versions prior to 5.3.0 Improved Sale Badges for WooCommerce versions prior to 4.4.0 Share, Print and PDF Products for WooCommerce versions prior ...

CVE-2023-2415

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitalogoutcallback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attacker...

CVE-2023-2299

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction...

CVE-2023-2434

The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings...

CVE-2023-2545

The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-2547

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2023-2547

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions...

PT-2023-19526 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages plugin for WordPress versions up to, and including, 3.2.3 Description: The issue is related to a missing capability check on the reset function, which allows authenticated attackers with editor-level permissions and above to rese...

UBUNTU-CVE-2023-2002

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

CVE-2023-2002

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...