5920 matches found
CVE-2023-41857
CVE-2023-41857 affects the WordPress Click To Tweet plugin up to version 2.0.14, described as a Missing Authorization / Broken Access Control vulnerability. The initial description and connected entries do not provide an explicit remediation or patched version. CVSS v3.1 base score is 5.4 (Medium...
CVE-2023-41803
CVE-2023-41803 : BitPay Checkout for WooCommerce (WordPress plugin) up to version 4.1.0 is affected by a Broken Access Control vulnerability due to missing authorization checks. The issue allows unauthenticated users to exploit inadequate access configuration to perform unauthorized actions. The ...
CVE-2023-41848
CVE-2023-41848 affects the WordPress Carousel Slider plugin, versions
CVE-2023-41802
CVE-2023-41802 affects WordPress Plugin Super Socializer (Team Heateor) up to version 7.13.54. It is a Missing Authorization / Broken Access Control vulnerability enabling exploitation of improperly configured access control security levels. Public sources in Connected documents confirm affected ...
CVE-2023-41695
CVE-2023-41695 is a WordPress plugin issue in Analytify (
CVE-2023-41690
CVE-2023-41690: WordPress WiserNotify Social Proof plugin <= 2.5 suffers a Broken Access Control flaw that allows unauthenticated access due to missing authorization checks. The CVE is tracked for WiserNotify Social Proof (WordPress plugin). Connected sources confirm affected versions up to 2....
CVE-2023-41688
CVE-2023-41688 affects WordPress Bulk NoIndex & NoFollow Toolkit (Mad Fish Digital) up to version 1.5, due to Broken Access Control / Missing Authorization. Public sources list a CVSS v3.1 base score of 5.4 (Medium) with network attack vector and low privileges required. Patchstack notes the fix ...
CVE-2023-41132
CVE-2023-41132 relates to the WordPress plugin Category Slider for WooCommerce (
CVE-2023-40005
Technical details (affected product, vulnerable components, root cause, impact, and fix) are not provided in the supplied documents. Monitor for updates from official advisories and vendors for CVE-2023-40005.
CVE-2023-40001
CVE-2023-40001 affects the WordPress plugin iThemes Sync (vulnerable:
CVE-2023-39305
CVE-2023-39305 affects the WordPress plugin Yet Another Stars Rating (YASR) up to version 3.4.3, with a Missing Authorization / Broken Access Control issue occurring via the plugin’s init flow. This allows unauthenticated attackers to perform unauthorized actions (e.g., modifying data) on affecte...
CVE-2023-35037
CVE-2023-35037 affects the WordPress Surfer plugin (surferseo): Broken access control in Surfer
CVE-2023-33324
CVE-2023-33324 is a Missing Authorization/Broken Access Control vulnerability in WordPress plugin Easy Captcha (versions up to 1.0). The issue arises from insufficient access checks, enabling unauthorized entities to perform restricted actions. The vulnerability affects Easy Captcha
forgejo -- multiple vulnerabilities
Problem Description: It was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action registration, password reset or secondary email validation could be used to perform a different action. It is no longer...
CVE-2023-23472
CVE-2023-23472 affects IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7). An authenticated user could obtain sensitive information that could aid further attacks. The vulnerability is described in IBM’s bulletin as an information-disclosure issue with a CVSS v3.1 base sc...
CVE-2023-37395
CVE-2023-37395 affects IBM Aspera Faspex 5.0.0–5.0.7, where a local user could obtain sensitive information due to improper encryption of certain data. The Red Hat and other security sources corroborate an information disclosure vulnerability in Faspex 5.x, with the IBM bulletin explicitly listin...
CVE-2023-41953
CVE-2023-41953 concerns the WordPress plugin ProfilePress (Membership Team) up to version 4.13.1, where a Missing Authorization vulnerability exists. The connected PT-2023-8991 document attributes the issue to a flaw in the admin_notice() path that enables a CSRF attack due to incorrect nonce val...
CVE-2023-48277
CVE-2023-48277 affects the WordPress plugin Super Progressive Web Apps (up to version 2.2.21). The vulnerability is a Broken Access Control caused by missing authorization in the newsletter submission AJAX path, allowing unauthenticated users to subscribe to the plugin author’s newsletter. The ve...
CVE-2023-27428
CVE-2023-27428 affects WordPress WP users media plugin, vulnerable ≤ 4.2.3 due to missing authorization/broken access control. Technical details in connected docs cite a Missing Authorization/CSRF issue on wpusme_save_settings, enabling unauthorized/settings modification for affected users. No pa...