CVE-2025-65287

creationtimestamp| type| source ---|---|--- 2025-12-09 15:56:30+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115690424892712546...

CVE-2025-65804

creationtimestamp| type| source ---|---|--- 2025-12-08 17:46:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115685195052401612 2025-12-08 19:52:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7iskxtus72x...

CVE-2025-13666

CVE-2025-13666 refers to the Helloprint WordPress plugin (WordPress Helloprint plugin) with vulnerability in versions up to and including 2.1.2. The issue is Missing Authorization due to a publicly registered REST API endpoint that does not verify request authenticity, enabling unauthenticated ac...

CVE-2025-14092

creationtimestamp| type| source ---|---|--- 2025-12-05 16:13:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667841253149237...

CVE-2025-12355

CVE-2025-12355 refers to the Payaza WordPress plugin. The vulnerability is a missing capability check on the AJAX endpoint wp_ajax_nopriv_update_order_status, allowing unauthenticated attackers to modify order statuses. Affected versions are all up to and including 0.3.8. The public reports descr...

CVE-2025-12355 Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxnoprivupdateorderstatus' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses...

WordPress Payaza plugin <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update vulnerability

Missing Authorization to Unauthenticated Order Status Update vulnerability discovered by Legion Hunter in WordPress Plugin Payaza versions = 0.3.8...

CVE-2025-57850

creationtimestamp| type| source ---|---|--- 2025-12-02 19:16:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651575723555326 2025-12-02 21:35:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6zvkp3lak2k...

CVE-2024-59373

creationtimestamp| type| source ---|---|--- 2025-11-25 15:05:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115610951630509357...

CVE-2025-12634 Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2025-199565

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-12634

The CVE-2025-12634 entry concerns the WordPress plugin Refund Request for WooCommerce. A missing capability check in the update_refund_status function affects all versions up to and including 1.0, allowing authenticated users with Subscriber-level access or higher to modify refund statuses to app...

WordPress Refund Request for WooCommerce plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update vulnerability

Missing Authorization to Authenticated Subscriber+ Refund Status Update vulnerability discovered by Powpy in WordPress Plugin Refund Request for WooCommerce versions = 1.0...

CVE-2025-65222

creationtimestamp| type| source ---|---|--- 2025-11-20 15:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115582661903555688...

CVE-2025-12392

CVE-2025-12392 affects the WordPress plugin “Cryptocurrency Payment Gateway for WooCommerce.” The root cause is a missing capability check in the handle_optin_optout() function, allowing unauthenticated attackers to modify tracking opt-in/out settings in all versions up to 2.0.22. The practical i...

CVE-2025-12762

creationtimestamp| type| source ---|---|--- 2025-11-13 15:04:12+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115542999175905854 2025-11-13 16:09:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5jkgyz7zy2q 2025-11-13 16:30:12+00:00| seen|...

CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

CVE-2025-12271

creationtimestamp| type| source ---|---|--- 2025-10-27 13:49:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115446447915141841...

CVE-2025-11564 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it...