CVE-2025-4683 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createblog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, wit...

CVE-2025-4683

CVE-2025-4683 affects the WordPress plugin “MStore API – Create Native Android & iOS Apps On The Cloud” up to and including version 4.17.5. The root cause is a missing capability check in the create_blog function, enabling authenticated attackers with Subscriber-level access and above to create n...

CVE-2024-34695

WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously reques...

CVE-2024-6012

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...

CVE-2024-4199

The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access an...

CVE-2024-1516

The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the checkforsaaspush function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrar...

CVE-2024-0900

The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elesparecreatepost function hooked via AJAX in all...

CVE-2023-0557

The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts...

CVE-2023-0556

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata via the function cstugetmetadata that...

CVE-2021-37863

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...

CVE-2017-8298

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

CVE-2025-43853

creationtimestamp| type| source ---|---|--- 2025-05-15 17:34:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16543 2025-05-15 19:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b7f5nh2e...

CVE-2025-30965

creationtimestamp| type| source ---|---|--- 2025-04-15 12:38:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmu3tdv34v2h 2025-04-15 12:54:27+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11787 2025-04-15 15:46:06+00:00| seen| https://t.me/cvedetector/22935...

GHSA-VJH7-7G9H-FJFH

creationtimestamp| type| source ---|---|--- 2025-02-20 12:03:12+00:00| seen| https://bsky.app/profile/oracularhades.com/post/3limaobomek22 2025-03-06 12:59:52+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/11893 2025-03-07 05:49:30+00:00| published-proof-of-concept|...

WordPress Sync Post With Other Site plugin <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update vulnerability

Missing Authorization to Authenticated Subscriber+ Post Creation and Update vulnerability discovered by Lucio Sá in WordPress Plugin Sync Post With Other Site versions = 1.6...

CVE-2024-6012

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...

WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.19 - Cross-Site Request Forgery to Post Creation vulnerability

Cross-Site Request Forgery to Post Creation vulnerability discovered by JoanClarke2 in WordPress Plugin Robo Gallery versions = 3.2.19...

WordPress Boostify Header Footer Builder for Elementor plugin <= 1.3.5 - Missing Authorization to Page/Post Creation vulnerability

Missing Authorization to Page/Post Creation vulnerability discovered by Lucio Sá in WordPress Plugin Boostify Header Footer Builder for Elementor versions = 1.3.5...

WordPress YouTube Video Gallery by YouTube Showcase plugin <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation vulnerability

Missing Authorization to Arbitrary Post/Page Creation vulnerability discovered by Lucio Sá in WordPress Plugin YouTube Showcase versions = 3.3.6...

WordPress Plugin youtube-showcase 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...