Design/Logic Flaw

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...

CVE-2020-36725 TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated...

CVE-2020-36725

The CVE-2020-36725 entry concerns the TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress. Affected components are the plugin code handling options via the file ti-woocommerce-wishlist/includes/export.class.php, with vulnerable versions up to 1.21.11 (Wishlist) and up to...

CVE-2020-36720

The CVE concerns the Kali Forms plugin for WordPress, affected up to version 2.1.1. Root cause: the update_option function lacks proper authentication checks, allowing any authenticated attacker to change or delete plugin settings. Impact is authenticated options changes, which can affect configu...

CVE-2020-36720 Kali Forms <= 2.1.1 - Missing Authorization to Settings Update

The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the updateoption lacking proper authentication checks. This makes it possible for any authenticated attacker to change or delete the plugin's settings...

CVE-2019-25142 Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...

CVE-2019-25142

The Mesmerize (up to 1.6.89) and Materialis (up to 1.0.172) WordPress themes are vulnerable to authenticated options changes due to companion_disable_popup not fully validating input before update_option. This allows authenticated attackers to modify restricted options. Remediation: upgrade Mesme...

CVE-2019-25142 Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...

PT-2023-11867 · Unknown · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist versions up to 1.21.11 TI WooCommerce Wishlist Pro versions up to 1.21.4 Description: The issue allows authenticated attackers to gain restricted access to the vulnerable blog and update any settings due to an Options...

Elementor Pro Plugin for WordPress < 3.11.7 Authenticated Arbitrary WordPress Options Change

The WordPress Elementor Pro Plugin installed on the remote host is affected by a broken access control vulnerability that could allow a full site takeover. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No sourc...

CVE-2022-42459

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin = 9.7.1 on WordPress...

Code injection

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin = 9.7.1 on WordPress...

CVE-2022-42459

CVE-2022-42459 affects the WordPress Image Hover Effects Ultimate plugin (versions

CVE-2022-42459 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin = 9.7.1 on WordPress...

PT-2022-26442 · WordPress · Image Hover Effects Ultimate

Name of the Vulnerable Software and Affected Versions: Image Hover Effects Ultimate plugin versions prior to 9.7.1 Description: The issue concerns an authentication WordPress options change vulnerability in the Image Hover Effects Ultimate plugin. Recommendations: For versions prior to 9.7.1,...

WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change vulnerability discovered by Vlad Vector Patchstack in the WordPress Image Hover Effects Ultimate plugin versions = 9.7.1. Solution Update the WordPress Image Hover Effects Ultimate plugin to the latest available version at least 9.7.2...

Design/Logic Flaw

Auth. WordPress Options Change siteurl, userscanregister, defaultrole, adminemail and newadminemail vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin versions = 2.0.3 on WordPress...

CVE-2022-38104

The CVE-2022-38104 issue affects the WordPress plugin Accordions (also called Accordions – Multiple Accordions or FAQs Builder) versions = 2.1.0 (latest available) to fix the authenticated options change vulnerability. No exploitation details are provided in the documents; MITRE IDs are not expli...

CVE-2022-38104 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change siteurl, userscanregister, defaultrole, adminemail and newadminemail vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin versions = 2.0.3 on WordPress...

CVE-2022-38104 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change siteurl, userscanregister, defaultrole, adminemail and newadminemail vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin versions = 2.0.3 on WordPress...