CVE-2024-24715

CVE-2024-24715 refers to the WordPress plugin BookIt (The Booking Calendar) and affects versions

CVE-2024-22139

CVE-2024-22139 (WordPress Manutenção) is an unauthenticated authentication bypass arising from IP spoofing, affecting WordPress Manutenção versions up to and including 1.0.6. The root cause involves insufficient validation of IP addresses in maintaining mode, enabling bypass of the maintenance re...

CVE-2023-51483

CVE-2023-51483 affects Glowlogix WP Frontend Profile for WordPress. The vulnerability is an Unauthenticated Privilege Escalation caused by Improper Privilege Management in the plugin, impacting WP Frontend Profile versions up to 1.3.1. Public disclosures in the connected documents confirm the iss...

CVE-2023-51424

CVE-2023-51424 affects WebinarIgnition (WordPress Webinar plugin) up to version 3.05.0. The issue is an unauthenticated privilege escalation due to improper privilege management. Public details in Wordfence/EU listings show an in-the-wild risk with a CVSS v3.1 base score of 9.8 (CRITICAL), networ...

CVE-2023-51401

Technical details (affected version, root cause, exploit vectors, and patch status) for CVE-2023-51401 are not provided in the connected documents. Monitor vendor advisories and CVE records for updates and remediation specifics.

CVE-2023-51398

CVE-2023-51398 is an authentication‑related vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder. The issue stems from improper privilege management that enables Privilege Escalation for authenticated users (Contributor+), potentially granting higher privileges than allowed. Affec...

CVE-2023-49753

CVE-2023-49753 affects the Adifier System WordPress plugin and is a Local File Inclusion vulnerability caused by improper pathname restrictions in the Adifier System before 3.1.4. The issue enables unauthenticated local file inclusion, contributing to potential code execution or sensitive data ex...

CVE-2023-48757

CVE-2023-48757 affects Crocoblock JetEngine (WordPress plugin) and enables Privilege Escalation due to Improper Privilege Management. Affected versions are JetEngine and earlier than or equal to 3.2.4; the vulnerability allows an authenticated attacker with Contributor+ privileges to escalate, as...

CVE-2023-48319

CVE-2023-48319 affects the WordPress plugin Salon booking system (salon-booking-system) up to version 8.6. It is an Improper Privilege Management vulnerability that enables Privilege Escalation for users with Editor-level access, potentially granting Administrator privileges. The issue is fixed i...

CVE-2023-47682

CVE-2023-47682 affects the WordPress WP User Frontend plugin (versions ≤3.6.5). The issue is improper privilege management that allows authenticated users (author level and above) to escalate privileges, potentially enabling admin-level access via the registration_form function. The vulnerability...

CVE-2023-47178

CVE-2023-47178 describes an unauthenticated Local File Inclusion (path traversal) vulnerability in The Plus Addons for Elementor Pro. Affected versions are up to and including 5.2.8 (the patch to fix is 5.2.9). The issue arises from improper limitation of a pathname to a restricted directory, ena...

CVE-2023-46784

CVE-2023-46784 affects WordPress ICS Calendar plugin

CVE-2023-46205

CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...

CVE-2023-46197

CVE-2023-46197: Path traversal vulnerability in Popup by Supsystic (WordPress plugin) allowing relative path traversal in versions up to 1.10.19. Exploitation path observed via getWpCsvList; unauthenticated access possible per Patchstack documenting arbitrary file download risk. Affected: Popup b...

CVE-2024-25595

CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...

CVE-2023-41956

The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...

CVE-2023-41954

The ProfilePress Membership Team plugin for WordPress is affected by an Improper Privilege Management vulnerability in versions through 4.13.1 . This flaw allows for unauthenticated limited privilege escalation , where an attacker can gain unauthorized access to restricted features or data. The i...

CVE-2023-41665

CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP

CVE-2023-41243

The WPvivid Backup and Migration WordPress plugin (versions 0.9.90 and earlier ) is affected by an Improper Privilege Management vulnerability. This flaw allows for Privilege Escalation , where an attacker with Subscriber privileges can potentially gain unauthorized access or control over the sys...

CVE-2023-38399

CVE-2023-38399 concerns a Local File Inclusion (path traversal) in WordPress plugin Phlox Portfolio by Averta. The vulnerability affects Phlox Portfolio versions up to 2.3.1 and is exploitable without authentication due to improper limitation of a pathname to a restricted directory. Patchstack an...