CVE-2024-37106

CVE-2024-37106 pertains to the WishList Member X WordPress plugin. Affected versions are WishList Member X up to 3.26.6. The issue is a Missing/Unauthenticated Authorization flaw that enables Stored Cross-Site Scripting when an attacker exploits misconfigured access control for sensitive areas. T...

CVE-2024-37106 WordPress WishList Member X plugin < 3.26.7 - Unautenticated Plugin Settings Change Leading to Stored XSS vulnerability

Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6...

CVE-2024-37119

CVE-2024-37119 concerns Uncanny Automator Pro for WordPress. The connected sources indicate a Missing Authorization vulnerability that can allow an unauthenticated actor to reset license settings due to misconfigured access controls, affecting Uncanny Automator Pro up to version 5.3.0.0 (and rela...

CVE-2024-37123

The CVE-2024-37123 entry concerns the WordPress Ibtana plugin (WordPress Plugin Ibtana/IBTana Visual Editor) with versions

CVE-2024-37123 WordPress Ibtana – WordPress Website Builder plugin <= 1.2.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3...

CVE-2024-37123 WordPress Ibtana – WordPress Website Builder plugin <= 1.2.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3...

CVE-2024-37201 WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2...

CVE-2024-37201

CVE-2024-37201: A Missing Authorization vulnerability in the WordPress plugin WooCommerce Customers Order History (javmah) permits access control bypass for the plugin’s Order History data in versions up to 5.2.2. The issue stems from incorrectly configured access control security levels. Accordi...

CVE-2024-37201 WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in javmah Woocommerce Customers Order History allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woocommerce Customers Order History: from n/a through 5.2.2...

CVE-2024-37204 WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9...

CVE-2024-37203 WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9...

CVE-2024-37203

CVE-2024-37203 affects Laybuy Payment Extension for WooCommerce (up to version 5.3.9). Root cause: Missing/incorrectly configured authorization (Broken Access Control) allowing unauthorized access actions. CVSS v3.1 base score 4.3 (Medium). Remediation: upgrade to a version later than 5.3.9; no f...

CVE-2024-37203 WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9...

CVE-2024-37207 WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2...

CVE-2024-37207 WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2...

CVE-2024-37207

CVE-2024-37207 affects Theme4Press Demo Awesome (WordPress plugin) up to version 1.0.2. Described as a Missing Authorization / Broken Access Control vulnerability due to incorrectly configured access levels, enabling unauthorized access to restricted functionality. Affected range: n/a through 1.0...

CVE-2024-37214 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability

Missing Authorization vulnerability in Dropshipping Guru Ali2Woo Lite Exploiting Incorrectly Configured Access Control Security Levels, Stored XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5...

CVE-2024-37218

CVE-2024-37218 describes a Missing Authorization vulnerability in WordPress Page Builder Sandwich – Front-End Page Builder (Page Builder Sandwich) up to version 5.1.0. The issue stems from incorrectly configured access control security levels, enabling unauthorized access to protected functionali...

CVE-2024-37220 WordPress Optinly plugin <= 1.0.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18...

CVE-2024-37220

CVE-2024-37220 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Optinly by OptinlyHQ. It affects Optinly versions available up to and including 1.0.18 (n/a through 1.0.18 in the initial description). The issue stems from incorrectly configured access...