CVE-2024-12296

CVE-2024-12296 — Apus Framework (WordPress) vulnerability : The Apus Framework plugin is affected in versions up to 2.3. It has a missing capability check in the import_page_options function, allowing authenticated users with Subscriber-level access or higher to perform arbitrary options updates....

CVE-2024-12213

CVE-2024-12213 affects the WordPress plugin WP Job Board Pro, where an attacker can specify the role during user registration, enabling unauthenticated privilege escalation to administrator on vulnerable sites. Technical details in connected docs indicate the issue arises from processing the regi...

CVE-2024-13653

The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backupoptions' function in all versions up to, and including, 2.12.0. This makes it possible fo...

CVE-2024-13421

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to...

CVE-2024-13653

CVE-2024-13653 affects ZoxPress (WordPress Theme) versions up to 2.12.0. A missing capability check in the backup_options function allows authenticated attackers with Subscriber-level access or higher to modify arbitrary options, enabling potential privilege escalation (e.g., changing the default...

PT-2025-6457 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Apus Framework plugin for WordPress versions prior to 2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site due to a missing capability check on the...

WordPress plugin WP Job Board Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-6456 · WordPress · Wp Job Board Pro

Name of the Vulnerable Software and Affected Versions: WP Job Board Pro plugin for WordPress versions up to, and including, 1.2.76 Description: The issue is related to privilege escalation due to the plugin allowing a user to supply the role field when registering, making it possible for...

PT-2025-6435 · WordPress · The Real Estate 7

Name of the Vulnerable Software and Affected Versions: The Real Estate 7 WordPress theme for WordPress versions up to, and including, 3.5.1 Description: The issue is due to the plugin not properly restricting the roles allowed to be selected during registration, making it possible for...

PT-2025-6436 · Zoxpress +1 · Zoxpress +1

Name of the Vulnerable Software and Affected Versions: The ZoxPress - The All-In-One WordPress News Theme versions up to, and including, 2.12.0 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the backup options...

WordPress WP Foodbakery plugin <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation vulnerability

Unauthenticated Privilege Escalation in foodbakeryregistrationvalidation vulnerability discovered by Tonn in WordPress Plugin FoodBakery versions = 4.7...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: ts2020: Fix for nullptrderef in ts2020probe KASAN reported a nullptrderef issue when executing the following command: bash echo ts2020 0x20 /sys/bus/i2c/devices/i2c-0/newdevice KASAN: Nullptrderef in range...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Set video drvdata before registering the video device The video drvdata should be set before the video device is registered. Otherwise, videodrvdata may return NULL in the open file operations, leading to errors...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fpga: region: adding an owner module and taking its reference count The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fpga: manager: Added a module owner pointer and used it to count the module’s references. The current implementation of the fpga manager assumes that the low-level module registers a driver for the parent device and uses its...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: x86-android-tablets: Fixed errors related to use of pdevs after the free function is called via platformdeviceregister. The x86androidtabletremove function frees the pdevs array; therefore, it should not be used...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure Otherwise, the notifier remains registered, and a subsequent attempt to enable eswitch may trigger warnings of the following type: 682.589148 ------------ Cut here -----------...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: eeprom: at24 – fixed a memory corruption race condition. If the eeprom is not accessible, a nvmem device will be registered. In this case, the read operation will fail, and the device will be torn down. If another driver...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: When CONFIGDEBUGFS or CONFIGDEBUGFSALLOWALL is not set, the function btdebugfs may not be created successfully. As a result, the isoinit function returns early without setting isoinited to true. This causes duplicat...

CVE-2025-0180

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on...