4451 matches found
CVE-2024-12542
CVE-2024-12542 linkID = 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and...
CVE-2024-7135
CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...
CVE-2023-3124
CVE-2023-3124 CVE-2023-3124 Proof of Concept This is a proof of concept PoC exploit for CVE-2023-3124, a vulnerability in WordPress Elementor Pro plugin. Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the...
CVE-2024-56067
CVE-2024-56067 WP SuperBackup = 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and...
EUVD-2026-109350
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to t...
CVE-2023-4800
CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...
CVE-2024-10578
CVE-2024-10578: Pubnews = 1.0.7 - Unauthenticated Arbitrary Plugin Installation Description The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and...
CVE-2024-10629
🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...
CVE-2024-54239
CVE-2024-54239 Eyewear prescription form = 4.0.18 - Missing Authorization to Unauthenticated Arbitrary Options Update Description The Eyewear prescription form plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability...
CVE-2024-9234
CVE-2024-9234 GutenKit = 2.1.0 - Unauthenticated Arbitrary File Upload Description The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the...
CVE-2020-12077
CVE-2020-12077 MapPress Maps Pro 2.53.9 - Remote Code Execution RCE due to Incorrect Access Control in AJAX Actions Description The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’,...
CVE-2024-43918
Wordpress WBW Product Table Pro = 1.9.4 - Unauthenticated Arbitrary SQL Execution to Remote Code Execution CVE-2024-43918 The WBW Product Table Pro plugin for WordPress is vulnerable to unauthorized arbitrary SQL Execution due to a missing capability check on a function in all versions up to, and...
CVE-2024-7856
CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p Example python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...
CVE-2024-12252
CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Missing Authorization to File Overwrite/Upload Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and...
CVE-2022-1329
CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...
PoC_CVE-2025-2568
PoC CVE-2025-2568 Overview The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the vayublocksgettoggleswitchvaluescallback and vayublockssavetoggleswitchcallback...
CVE-2024-12252
SEO LAT Auto Post = 2.2.1 - Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated...
CVE-2024-13800
CVE-2024-13800 Popup Plugin For WordPress - ConvertPlus = 3.5.30 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing...
CVE-2024-12535
CVE-2024-12535 Host PHP Info = 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure Description The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions ...