CVE-2022-0164

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its comingsoonsendmail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users...

EUVD-2023-1638

Malicious code in bioql PyPI...

CVE-2025-3863

CVE-2025-3863 affects the WordPress plugin Post Carousel Slider for Elementor . The vulnerability is due to a missing capability check in the function process_wbelps_promo_form() across versions up to 1.6.0. This enables authenticated attackers with Subscriber-level access and above to trigger th...

CVE-2024-3243

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-13371

CVE-2024-13371 affects the WordPress plugin WP Job Portal (versions up to and including 2.2.6). The root cause is a missing capability check in the function sendEmailToJobSeeker() , allowing unauthenticated attackers to send arbitrary emails with arbitrary content from the site’s mail server. The...

CVE-2024-5969

The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomaticsendemail' function which are reachable via AJAX...

CVE-2024-5969

The CVE-2024-5969 entry concerns the WordPress plugin AIomatic - Automatic AI Content Writer, affected versions up to and including 2.0.5. Multiple connected sources describe an unauthenticated arbitrary email-sending vulnerability in the aiomatic_send_email function, reachable via AJAX, allowing...

WordPress Shared Counts <= 1.4.1 - Missing Authorization to Arbitrary Email Sending vulnerability

Missing Authorization to Arbitrary Email Sending vulnerability discovered by ? in WordPress Plugin Shared Counts versions = 1.4.1...

WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability

Unauthenticated Arbitrary Email Sending vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Bricksforge versions = 2.0.17...

Yahoo! Messenger buffer overflow

Buffer overflow in YMSGR:sendfile? URL on large number of ''...